FreeRDP CVE-2026-121390

Exploitation requires that the FreeRDP client be built with the optional WITH_AAD=ON flag (the PoC also uses WITH_WINPR_JSON=ON); the advisory states the default AAD-off client does not compile the ARM gateway route and is therefore unaffected. The user must select/configure and connect to a malicious or malformed ARM gateway (e.g. /gateway:type:arm,...), which then returns an HTTP 200 JSON ARM connection response that either omits the redirectedServerCert key entirely or supplies it as a non-string value. Limiting factors that reduce realistic risk: the non-default build requirement, the passive user interaction of pointing the client at the attacker gateway (UI:P), and an impact confined to client-side availability (crash) with no confidentiality or integrity effect.

All signals converge on a genuinely moderate, availability-only issue rather than a top-priority emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, base 5.3) shows network reach and low complexity with no privileges, but passive user interaction (UI:P) and impact limited to low availability of the vulnerable system (VA:L) with zero confidentiality or integrity effect. The FreeRDP/VulnCheck advisory explicitly confirms the demonstrated impact is client-side availability loss only - no authentication bypass, data disclosure, or data modification. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a non-emergency DoS. A full working loopback reproducer is embedded in the advisory, which raises the practical exploitation floor, but it crashes only the client process the user themselves pointed at a malicious gateway. No CISA KEV listing is present, so this is not confirmed actively exploited; no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared here - STATE EXPLICITLY: EPSS is missing from the data. A critical scoping constraint that lowers real-world risk: the flaw only exists when the client is compiled WITH_AAD=ON, and the advisory states the audited default AAD-off client does not even compile the ARM gateway route. Net: this is a real, source-confirmed bug worth patching on a normal cadence, not a high-CVSS-but-illusory finding, but it is also not a widespread-exploitation priority.

A user of an AAD-enabled FreeRDP client (WITH_AAD=ON) is induced to connect through an attacker-controlled or malformed ARM gateway. The gateway returns an HTTP 200 JSON response that omits (or sets to a non-string) the redirectedServerCert field, causing the parser to pass a null buffer into the certificate parser and trip an assertion that aborts the client (SIGABRT). A complete loopback-only reproducer harness is embedded in the advisory, so the crash path is publicly demonstrated, though only against a local fake gateway.