CVE-2026-121410Medium· 4.3▾ TwilightPoC availableFreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width an…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.
FreeRDP < 3.32.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91955High· 7.5FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server
CVE-2026-121950Medium· 6.5FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
CVE-2026-121951High· 7.5FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event
CVE-2026-121952Critical· 9.8FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability
CVE-2026-121953Critical· 9.8FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close
CVE-2026-121954Medium· 6.5FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec