CVE-2026-121960: 
NixOS Schwachstellenanalyse und -minderung

CVE-2026-121960 is a pre-authentication denial-of-service vulnerability in FreeRDP's NLA-enabled shadow server, triggered when a CredSSP TSRequest omits the negoTokens field. All FreeRDP versions before 3.32.2 are affected. The vulnerability was published on November 4, 2026, with a patch available in version 3.32.2. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is a reachable assertion (CWE-617) in FreeRDP's WinPR library. When a client sends a seven-byte CredSSP TSRequest containing only the version field (30 05 a0 03 02 01 06) and omitting the negoTokens [1] tag, nla_decode_ts_request leaves the initial negoToken SecBuffer zeroed. This null pvBuffer is subsequently passed through nla_server_authenticate → credssp_auth_authenticate → AcceptSecurityContext → WinPR Negotiate's guessMech → WinPrAsn1Decoder_InitMem, where a WINPR_ASSERT(source) fires and aborts the entire server process. The fatal assertion is active in the default CMake build configuration (WITH_VERBOSE_WINPR_ASSERT=ON), even when NDEBUG is set; builds with both WITH_VERBOSE_WINPR_ASSERT=OFF and NDEBUG are not confirmed to crash (FreeRDP Advisory).

Successful exploitation causes the FreeRDP shadow server process to abort with exit code 134, immediately terminating all active remote desktop sessions hosted by that server instance. The impact is limited to availability — there is no demonstrated confidentiality or integrity compromise, no code execution, and no lateral movement primitive. Any users connected to the shadow server at the time of the attack are disconnected, and the service must be restarted to restore functionality (FreeRDP Advisory, GitHub Advisory).

A complete, runnable Python proof-of-concept (repro_tsrequest_assert.py) is publicly available in the FreeRDP security advisory, demonstrating the crash with high confidence. The exploit requires no authentication, no user interaction, and no special privileges — only network access to the shadow server's TCP port. The attack is automatable and was confirmed to crash the server in both stock and AddressSanitizer builds. As of the time of publication, there is no evidence of in-the-wild exploitation, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog (FreeRDP Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FreeRDP shadow server instances (default port 3333, or custom) running versions before 3.32.2 with NLA (HYBRID security) enabled, using tools such as Shodan, Censys, or nmap.
2. Establish TCP connection and perform X.224 negotiation: Connect to the target host and port, then send a TPKT-wrapped X.224 Connection Request with RDP_NEG_REQ type 1 and requested protocol value 2 (HYBRID/NLA). Read the server's NEG_RSP to confirm NLA is offered.
3. Upgrade to TLS: Wrap the socket with TLS (certificate verification disabled; TLS 1.2 or lower where required) to complete the transport-layer handshake expected by the CredSSP path.
4. Send malformed CredSSP TSRequest: Transmit the raw seven-byte payload 30 05 a0 03 02 01 06 over the TLS channel. This is a DER-encoded SEQUENCE containing only the version field (INTEGER 6) with no negoTokens [1] field.
5. Observe server crash: Attempt to read a response (e.g., up to 256 bytes with a short timeout). A dropped connection or socket error indicates the server's WINPR_ASSERT(source) fired in WinPrAsn1Decoder_InitMem, aborting the shadow server process and disconnecting all active sessions (FreeRDP Advisory).

• Network: Unexpected TCP connections to the FreeRDP shadow server port (default 3333) that complete a TLS handshake but send only 7 bytes before the connection drops; repeated short-lived connections from the same source IP targeting the RDP/shadow port.
• Logs: FreeRDP server logs showing a fatal assertion message such as WINPR_ASSERT(source) in asn1.c:885 (WinPrAsn1Decoder_InitMem) immediately followed by process exit with code 134; log entries indicating NLA negotiation started but no authentication completed.
• Process: Unexpected termination of the freerdp-shadow-cli process (exit code 134 / SIGABRT); monitoring tools or service managers (e.g., systemd) logging an abnormal restart of the FreeRDP shadow service.
• File System: Core dump files (e.g., core.*) generated in the working directory of the shadow server process following an abort, potentially containing stack traces referencing nla_server_authenticate, credssp_auth_authenticate, or guessMech (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which contains the fix for this vulnerability (FreeRDP Advisory). If immediate patching is not feasible, restrict network access to the FreeRDP shadow server port to trusted IP ranges using firewall rules, reducing exposure to unauthenticated attackers. As an additional measure, disable the NLA-enabled shadow server functionality if it is not required for operations. Organizations may also consider building FreeRDP with WITH_VERBOSE_WINPR_ASSERT=OFF combined with NDEBUG, though this configuration has not been fully confirmed to prevent the crash and is not a substitute for patching (GitHub Advisory).

The vulnerability was reported and patched by the FreeRDP project maintainers, with the advisory authored by akallabeth and published on October 20, 2026. The advisory includes a detailed technical write-up and a working reproducer script, reflecting the project's transparent disclosure practices. Automated vulnerability tracking platforms including VulnDB, CVEFeed, and radar.offseq.com indexed the issue shortly after publication, but no significant independent researcher commentary or broader media coverage has been identified (FreeRDP Advisory).