← CVE index
Vulnerability record/PUBLISHED/Published Nov 3, 2026 14:27:56 UTC

CVE-2026-121390

FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.

Base score5.3/ 10
SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck
Last updatedNov 7, 2026 02:48:36 UTC
PublishedNov 3, 2026 14:27:56 UTC
ReservedNov 3, 2026 12:26:31 UTC

Credits

  • opensec-intelligence
  • Kushalkhemka
  • mayank-jangid-moon