FreeRDP CVE-2026-121406

A FreeRDP client at version 3.32.1 or earlier must initiate a connection to an attacker-controlled or compromised RDP server, complete NLA authentication, and reach session activation; the server then opens the RDPGFX dynamic channel and sends a zero-output ZGFX payload (the single-segment 'E0 20 00' or the seven-byte empty multipart form). Exploitation is further gated on the client being built with verbose WinPR assertions enabled (WITH_VERBOSE_WINPR_ASSERT, the upstream CMake default) or compiled without NDEBUG - an assertion-disabled, NDEBUG-optimized build returned cleanly and does not abort. Limiting factors: the attack requires the victim to connect to a malicious server (UI:P), applies only to affected build configurations, and the verified live impact is specific to the xfreerdp client front end. Impact is limited to client crash (availability); no code execution, memory corruption, or information disclosure.

This is a medium-severity, denial-of-service-only issue (CVSS 4.0 5.3, provided in input) whose real-world priority is moderate rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) shows the only impact is low availability (VA:L) with no confidentiality or integrity effect - consistent with the advisory's explicit statement that no memory corruption, disclosure, or code execution was observed. The vuln.today Decision label is 'this_month' (not act_now/emergency), which matches the picture of a client crash rather than a server-side or wormable flaw. No EPSS score and no KEV status were provided in the input, so there is no evidence of active exploitation; this is not in CISA KEV. A public PoC does exist in the GHSA advisory (a component-level C reproduction confirmed to abort with exit 134, plus a described live xfreerdp test reaching the same assertion), so exploitability is demonstrated even though impact is limited. A critical nuance: the abort only occurs in builds compiled with verbose WinPR assertions (WITH_VERBOSE_WINPR_ASSERT, the upstream CMake default) or without NDEBUG; an assertion-disabled optimized build returned cleanly, so hardened/release builds with NDEBUG may not be affected - defenders should verify their build configuration. The key limiting factor is the UI:P requirement: the victim client must connect to an attacker-controlled or compromised RDP server, so this matters most where clients reach untrusted servers (connection brokers, gateways, honeypots, MitM positions).

A victim runs a FreeRDP-based client (version 3.32.1 or earlier) and connects to a malicious or compromised RDP server. After NLA authentication and session activation, the server opens the RDPGFX dynamic channel and sends a three-byte zero-output ZGFX payload (E0 20 00), which causes zgfx_decompress to return success with a null output pointer and triggers the WINPR_ASSERT in Stream_StaticConstInit, crashing the client (exit 134). A public component-level PoC and a described live xfreerdp reproduction exist in the vendor GHSA advisory, so the crash is reliably reproducible against assertion-enabled builds.