CVE-2026-121951FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

Beschreibung

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-4qq4-qwxq-49m8) vendor-advisoryExploitMitigationVendor Advisory
• VulnCheck Advisory: FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event third-party-advisoryThird Party Advisory