CVE-2026-121402: 
NixOS 脆弱性分析と緩和策

CVE-2026-121402 is a NULL pointer dereference vulnerability in FreeRDP that allows a malicious RDP server to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. All FreeRDP versions before 3.32.2 are affected; version 3.32.2 contains the fix. The vulnerability was published on November 3, 2026, with the patch available in the same release. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is improper input validation (CWE-20) combined with a NULL pointer dereference (CWE-476) in FreeRDP's GDI and RDPGFX handling code. The RDPGFX client parser in channels/rdpgfx/client/rdpgfx_main.c rejects dimensions above MAX_SURFACE_SIZE but does not reject zero-width values. When a zero-width RDPGFX_RESET_GRAPHICS_PDU is received, gdi_ResetGraphics commits the zero dimensions and calls gdi_resize_ex(0, h), which frees and nulls gdi->primary before attempting to allocate a replacement; the zero-width allocation via gdi_CreateCompatibleBitmap fails (returning NULL from calloc(0, h)), leaving gdi->primary as NULL without terminating the session. A subsequent ordinary bitmap update reaching gdi_Bitmap_Paint dereferences context->gdi->primary->hdc, causing a SIGSEGV crash (FreeRDP Advisory).

Successful exploitation results in a denial-of-service condition limited to the xfreerdp client process — the client crashes with a SIGSEGV (exit code 139), terminating the user's RDP session. There is no demonstrated impact on confidentiality or integrity, and no attacker-controlled write or code execution has been shown. The scope is confined to the vulnerable client; no lateral movement or data exfiltration capability has been identified (FreeRDP Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must connect to a malicious RDP server — but no attacker privileges are required on the server side (GitHub Advisory, FreeRDP Advisory).

1. Set up a malicious RDP server: The attacker deploys a custom or modified RDP server capable of sending arbitrary RDPGFX PDUs, using FreeRDP's server-side API or a custom implementation after completing TLS/NLA capability exchange with the client.
2. Lure the victim to connect: The attacker tricks a Linux user running xfreerdp into connecting to the malicious server (e.g., via phishing, a malicious link, or a compromised RDP gateway).
3. Complete capability exchange: Allow the normal RDP handshake and RDPGFX capability negotiation to complete so the client enters the graphics pipeline state.
4. Send zero-width ResetGraphics PDU: Transmit an RDPGFX_CMDID_RESETGRAPHICS PDU with width=0 (and any non-zero height, e.g., 768) and monitorCount=0. This causes gdi_resize_ex to free and null gdi->primary without successfully recreating it.
5. Send a normal bitmap update: Transmit a valid bitmap update (e.g., a 1×1 pixel BITMAP_UPDATE). The client's gdi_Bitmap_Paint function dereferences the now-NULL gdi->primary->hdc, triggering a SIGSEGV and crashing the xfreerdp client process (FreeRDP Advisory).

• Logs: FreeRDP client logs showing reset error 1359 or similar RDPGFX ResetGraphics error codes immediately before a crash; log entries referencing gdi->primary=(nil) or primary_buffer=(nil) after a resize operation.
• Process: xfreerdp process terminating with exit code 139 (SIGSEGV); crash stack trace resolving to gdi_Bitmap_Paint in a backtrace or core dump.
• Network: RDP traffic from an unexpected or untrusted server IP containing an RDPGFX ResetGraphics PDU with zero-width dimensions followed immediately by a bitmap update PDU (FreeRDP Advisory).

Update FreeRDP to version 3.32.2 or later, which rejects zero desktop dimensions before invoking the graphics reset callback. As a workaround until patching is possible, avoid connecting xfreerdp clients to untrusted or unknown RDP servers, and restrict RDP connections to known, trusted servers only. The suggested code-level remediation is to reject zero-width/height values in the RDPGFX handler and to preserve the old primary display until a replacement is successfully created, or to close the session if the display state cannot be restored (FreeRDP Advisory, GitHub Advisory).