# CVE-2026-121960: FreeRDP denial of service in NLA shadow server via malformed TSRequest

Source: https://junglewise.ai/threats/cve-2026-121960-freerdp-before-3-32-2-contains-a-denial-of-service-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121960 · Severity: high · CVSS 7.5 · Published 2026-11-04

FreeRDP's shadow server is a component that enables remote desktop session shadowing and management. When NLA (Network Level Authentication) is enabled, an unauthenticated remote attacker can crash the entire shadow server by sending a malformed seven-byte credential request, causing all active sessions to drop and the service to become unavailable. This requires no credentials or authentication to exploit.

Technologies: [FreeRDP](https://junglewise.ai/threats/technologies/freerdp). Vendors: [FreeRDP](https://junglewise.ai/threats/vendors/freerdp).

## Quick answers

**Is CVE-2026-121960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121960 being exploited in the wild.

**How severe is CVE-2026-121960?** High severity, with a CVSS score of 7.5, published 4 November 2026.

**Which products and versions are affected?** FreeRDP before 3.32.2.

**Is there a fix for CVE-2026-121960?** Yes: fixed in 3.32.2. Until then: Disable NLA on the shadow server if it is not required, or restrict network access to the shadow server port to trusted clients only until the patch can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121960 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121960?** Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.2

Disable NLA on the shadow server if it is not required, or restrict network access to the shadow server port to trusted clients only until the patch can be applied.

## Technical details

A null-pointer dereference in the CredSSP TSRequest parsing leads to a fatal assertion (WINPR_ASSERT) when negoTokens are omitted from the request. The nla_decode_ts_request function leaves the negoToken SecBuffer null, which is then passed to AcceptSecurityContext via credssp_auth_authenticate, triggering the assertion in WinPrAsn1Decoder_InitMem. The vulnerability is reachable over the network before authentication occurs, and the attack vector is a seven-byte crafted payload (30 05 a0 03 02 01 06) sent after the TLS handshake.

## Affected products

- FreeRDP FreeRDP before 3.32.2

## Timeline

- 2026-10-20: disclosed
- 2026-11-04: advisory
- 2026-11-04: patched

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3pg4-5r42-wxvj](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3pg4-5r42-wxvj)
- [https://www.vulncheck.com/advisories/freerdp-before-3.32.2-unauthenticated-denial-of-service-via-credssp-tsrequest](https://www.vulncheck.com/advisories/freerdp-before-3.32.2-unauthenticated-denial-of-service-via-credssp-tsrequest)

## Related threats

- [FreeRDP heap use-after-free in brush cache](https://junglewise.ai/threats/cve-2026-125394-freerdp-before-3-33-0-contains-a-heap-use-after-free)
- [FreeRDP heap buffer overflow in RD Gateway RPC client](https://junglewise.ai/threats/cve-2026-121964-freerdp-before-3-32-2-contains-a-heap-based-buffer-overflow-in)
- [FreeRDP use-after-free in dynamic rdpsnd channel](https://junglewise.ai/threats/cve-2026-121963-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in)
- [FreeRDP heap out-of-bounds write in RDPGFX HashTable_GetKeys](https://junglewise.ai/threats/cve-2026-121958-freerdp-through-3-32-1-has-a-heap-out-of-bounds-write-in-the)
- [FreeRDP use-after-free in planar bitmap decoder](https://junglewise.ai/threats/cve-2026-121957-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability)