CVE-2026-121960: FreeRDP denial of service in NLA shadow server via malformed TSRequest

CVE-2026-121960 · Severity: high · CVSS 7.5 · Published 2026-11-04

FreeRDP's shadow server is a component that enables remote desktop session shadowing and management. When NLA (Network Level Authentication) is enabled, an unauthenticated remote attacker can crash the entire shadow server by sending a malformed seven-byte credential request, causing all active sessions to drop and the service to become unavailable. This requires no credentials or authentication to exploit.

Technologies: FreeRDP. Vendors: FreeRDP.

Quick answers

Is CVE-2026-121960 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-121960 being exploited in the wild.
How severe is CVE-2026-121960?
High severity, with a CVSS score of 7.5, published 4 November 2026.
Which products and versions are affected?
FreeRDP before 3.32.2.
Is there a fix for CVE-2026-121960?
Yes: fixed in 3.32.2. Until then: Disable NLA on the shadow server if it is not required, or restrict network access to the shadow server port to trusted clients only until the patch can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121960 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-121960?
Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.32.2

Disable NLA on the shadow server if it is not required, or restrict network access to the shadow server port to trusted clients only until the patch can be applied.

Technical details

A null-pointer dereference in the CredSSP TSRequest parsing leads to a fatal assertion (WINPR_ASSERT) when negoTokens are omitted from the request. The nla_decode_ts_request function leaves the negoToken SecBuffer null, which is then passed to AcceptSecurityContext via credssp_auth_authenticate, triggering the assertion in WinPrAsn1Decoder_InitMem. The vulnerability is reachable over the network before authentication occurs, and the attack vector is a seven-byte crafted payload (30 05 a0 03 02 01 06) sent after the TLS handshake.

Affected products

  • FreeRDP FreeRDP before 3.32.2

Timeline

  • 2026-10-20: disclosed
  • 2026-11-04: advisory
  • 2026-11-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.