CVE-2026-121394: 
NixOS vulnerability analysis and mitigation

CVE-2026-121394 is a Denial of Service vulnerability in FreeRDP caused by a reachable assertion failure in the RemoteFX RLGR decoder. Affecting FreeRDP versions 3.11.0 through 3.32.1, it allows a malicious RDP server to crash a connecting client by sending a RemoteFX tileset containing RLGR code 32767, which triggers a signed narrowing assertion in rfx_rlgr_decode (libfreerdp/codec/rfx_rlgr.c, line 357). The vulnerability was published on November 3, 2026, with a patch available in version 3.32.2. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-617 (Reachable Assertion): FreeRDP's rfx_rlgr_decode function performs a checked conversion of an RLGR code value to int16_t, but fails to validate that the value code + 1 (where code = 32767) is representable in a signed 16-bit integer before the assertion fires. The vulnerability is build-dependent — FreeRDP's WITH_VERBOSE_WINPR_ASSERT option defaults to ON in the inspected CMake configuration, meaning assertion-enabled builds will abort (exit 134) while assertion-disabled builds are unaffected. Exploitation requires the victim to connect to an attacker-controlled RDP server with RemoteFX surface decoding enabled; the attacker injects a crafted fast-path SURFCMDS surface-bits update containing a complete RemoteFX tileset with a malicious RLGR bitstream. A proof-of-concept relay script (rfx049-relay.py) was included in the advisory, demonstrating the attack in a loopback test environment (GitHub Advisory).

Successful exploitation results in a Denial of Service limited to the affected FreeRDP client process — the client aborts with signal 6 (SIGABRT). The advisory confirmed no memory corruption, confidentiality impact, integrity impact, or effects on other processes or the connecting server. The impact is scoped to the availability of the individual client session, with no evidence of lateral movement potential or data exposure (GitHub Advisory, Github Advisory).

A proof-of-concept relay script was publicly disclosed as part of the security advisory, demonstrating the crash in a controlled loopback environment. As of the publication date, there is no evidence of in-the-wild exploitation, no known threat actor attribution, and no listing in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (Github Advisory, GitHub Advisory).

1. Reconnaissance: Identify targets running FreeRDP versions 3.11.0–3.32.1 built with WITH_VERBOSE_WINPR_ASSERT=ON (the default CMake configuration). Targets must have RemoteFX surface decoding enabled.
2. Set up malicious RDP server: Deploy a rogue RDP server (e.g., using the FreeRDP shadow server or a custom implementation) that the victim can be induced to connect to.
3. Deploy relay/injection script: Run the rfx049-relay.py proof-of-concept relay between the victim client and the server. The relay forwards normal RDP traffic and injects a crafted fast-path SURFCMDS surface-bits update after the connection is established.
4. Inject malicious RemoteFX tileset: The relay injects a complete RemoteFX tileset whose RLGR bitstream emits code 32767. This reaches rfx_rlgr_decode in the client.
5. Trigger assertion failure: The client's rfx_rlgr_decode function attempts to convert code + 1 (32768) to int16_t, which overflows the signed type, triggering the WITH_VERBOSE_WINPR_ASSERT assertion and aborting the client process (exit 134) (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp) terminating unexpectedly with exit code 134 (SIGABRT) or log entries showing Caught signal 'Aborted' [6].
• Logs: FreeRDP client logs referencing rfx_rlgr_decode:357 at the time of crash; assertion failure messages from libfreerdp/codec/rfx_rlgr.c.
• Network: Unexpected or unsolicited fast-path SURFCMDS surface-bits update packets received from an RDP server shortly after connection establishment, particularly from unfamiliar or external RDP server addresses.
• Network: RDP connections to servers not in the organization's approved server list, especially those using /sec:rdp with RemoteFX (+rfx) enabled (GitHub Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which is the official patched release. As a workaround, avoid connecting to untrusted or unknown RDP servers, and restrict RDP client connections to verified, trusted internal servers only. Organizations can also consider building FreeRDP with WITH_VERBOSE_WINPR_ASSERT=OFF to prevent the assertion-triggered abort, though this does not fix the underlying input validation flaw. FreeRDP 2.x is unsupported and should be migrated to the 3.x branch (GitHub Advisory, Github Advisory).