FreeRDP Shadow Server CVE-2026-121407

The attacker must (1) authenticate to the FreeRDP shadow server with valid credentials - the CVSS PR:L confirms authentication is required, and the server only enables the remdesk channel after an authenticated client joins it - and (2) join the remdesk static virtual channel and write an 8192-byte payload whose eight-byte header declares a PDU length of 8. Exploitation is further LIMITED to deployments actually running the FreeRDP shadow-server mode (freerdp-shadow-cli), and to default assertion-enabled builds: per the advisory's source review, an assert-disabled NDEBUG build reaches a guarded channel error instead of aborting, so such builds are not crashed. No user interaction is required (UI:N) and the attack is network-reachable with low complexity (AV:N/AC:L).

This is a genuine but moderate-priority availability issue rather than a high-urgency threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the equivalent base severity 7.1 describe a network-reachable, low-complexity flaw that nonetheless requires an authenticated client (PR:L) and impacts availability only (VA:H; VC:N/VI:N). The GHSA advisory and VulnCheck confirm the mechanism, and the advisory itself contains working reproduction code with documented crashes (process exit status 134 on both stock and ASan builds), so a usable trigger is public. However, the input provides NO EPSS score and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation - exploitation is at most demonstrated in a lab, not observed in the wild. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with an authenticated, availability-only bug. Two factors meaningfully lower real-world risk below the raw score: exploitation requires valid credentials to the shadow server AND the affected component is the FreeRDP shadow-server mode specifically, not the far more common client/library usage. One important nuance: per source review, only default assertion-enabled builds abort; NDEBUG assert-disabled builds reach a guarded channel error instead - so impact is build-dependent and should be verified against your deployment. Net: patch this week on any exposed shadow-server deployment, but this is not a wormable, unauthenticated, or RCE-grade emergency.

An authenticated RDP client holding valid shadow-server credentials connects to a FreeRDP shadow server, joins the remdesk static virtual channel, and sends an 8192-byte payload whose first eight bytes declare a total PDU length of eight. The inverted framing check (PduLength >= Stream_GetPosition) leaves the stream at capacity, so the subsequent Stream_Seek triggers a fatal WinPR assertion that aborts the server and drops all active sessions. The GHSA advisory ships full reproduction code and documents successful crashes, but exploitation first requires authentication (PR:L) and low attack complexity (AC:L).