What is GHSA-pmj8-2jw3-72qf?

GHSA-pmj8-2jw3-72qf is a security advisory published by GitHub Security Advisories with High severity. FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious...

Which CVE IDs does GHSA-pmj8-2jw3-72qf cover?

GHSA-pmj8-2jw3-72qf covers the following CVE IDs: CVE-2026-121393. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pmj8-2jw3-72qf?

GHSA-pmj8-2jw3-72qf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-pmj8-2jw3-72qfHighCVSS 6.5

FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-121393 →

📋 Description

FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.

🔗 References (4)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qw2-8h66-pvpw
https://nvd.nist.gov/vuln/detail/CVE-2026-121393
https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-remotefx-region-assertion
https://github.com/advisories/GHSA-pmj8-2jw3-72qf