We have seen the same here and have a fix. Our diagnosis summary: guacamole-server 1.6.0 calls gdi_init() from its PreConnect callback. FreeRDP 3.31.0 moved rdpCache creation out of gdi_init_ex() into the core, where it now happens after PreConnect returns so gdi_init_ex() dereferences a NULL cache and every RDP connection kills the guacd child.
FreeRDP consider PreConnect an unsupported place to call it, so the fix belongs in Guacamole: move gdi_init(), and the update-> handler assignments that must follow it, into a PostConnect callback which 1.6.0 doesn't currently register at all. Tested against both FreeRDP 3.30.0 and 3.31.0 and it renders on both, so it isn't a 3.31-only shim and doesn't impose a version floor. We saw that Debian and (likely) Ubuntu build FreeRDP with -DNDEBUG, which compiles out the WINPR assertion so on those distros the same fault is a silent SIGSEGV with no log output whatsoever. We're waiting on JIRA approval to raise the issue and then can post the fix. Regards Stuart On 2026/09/08 13:43:25 "Hashizume, Keiko (RIS-HBE)" wrote: > Hi Nick, > > We have confirmed with Chainguard that their guacamole-server image build > applies no patches and is identical to your official tag. > Is this something that could be fixed in an upcoming release? Do you have a > target release timeline where this might land, so we can plan around it? > > Thank you, > > Keiko Hashizume > > Get Outlook for > Mac<https://aka.ms/GetOutlookForMac><https://aka.ms/GetOutlookForMac%3E>; > > From: Nick Couchman <[email protected]> > Date: Friday, September 4, 2026 at 2:00 PM > To: [email protected] <[email protected]> > Subject: Re: Guacamole Bug: gdi_init_ex() crashes on NULL rdpCache for a > normal connecting client (guacamole-server) > > [You don't often get email from [email protected]. Learn why this is important > at https://aka.ms/LearnAboutSenderIdentification ] > > ⚠ External email If the sender is unfamiliar, check home.relx.com → Trusted > partners to verify them. > > > > On Fri, Sep 4, 2026 at 1:41 PM Hashizume, Keiko (RIS-HBE) > <[email protected]> wrote: > > > > gdi_init_ex() crashes with a failed WINPR_ASSERT(cache) inside > > brush_cache_register_callbacks() when called by Chainguard's > > guacamole-server image's RDP plugin (the stock apache/guacamole-server > > 1.6.0 codebase, packaged by Chainguard) — a normal, fully-connecting RDP > > client (completes capability negotiation, authentication, and framebuffer > > format agreement) — starting with FreeRDP 3.31.0. > > > > guacd[N]: INFO: Loading keymap "en-us-qwerty" > > guacd[N]: DEBUG: Local framebuffer format PIXEL_FORMAT_BGRX32 > > guacd[N]: DEBUG: Remote framebuffer format PIXEL_FORMAT_BGRA32 > > guacd[N]: DEBUG: ((cache)) > > [./libfreerdp/cache/brush.c:brush_cache_register_callbacks:230] > > guacd[N]: DEBUG: 0: ... libwinpr3.so.3 ... > > guacd[N]: DEBUG: 1: ... dli_sname=winpr_log_backtrace_ex ... > > guacd[N]: DEBUG: 2: ... dli_sname=winpr_int_assert ... > > guacd[N]: DEBUG: 3: ... dli_fname=/usr/lib/libfreerdp3.so.3, > > dli_sname=gdi_init_ex ... > > guacd[N]: DEBUG: 4: ... dli_fname=/usr/lib/libguac-client-rdp.so ... > > guacd[N]: DEBUG: 5: ... dli_sname=freerdp_connect ... > > guacd[N]: DEBUG: 6: ... dli_sname=guac_rdp_client_thread ... > > guacd[1]: INFO: Connection removed. > > > > Environment > > Distribution: Chainguard's guacamole-server container image (packages the > > stock apache/guacamole-server 1.6.0 codebase, bundled with their own > > independently-versioned FreeRDP build) — not Apache's own official Docker > > Hub image, and not a from-source build with any local patches to the RDP > > plugin > > FreeRDP: 3.31.0-r1 and 3.31.1 (Chainguard guacamole-server tags > > 1.6.0-r10/1.6.0-r11) > > Confirmed absent in FreeRDP 3.27.1 (Chainguard guacamole-server:1.6.0-r9) > > and 3.30.0 > > Platform: linux/amd64 (also reproduced via qemu emulation from linux/arm64 > > host) > > guacamole-server application version: 1.6.0 (unchanged across all tags > > above — only the bundled FreeRDP version differs) > > > > I'd be curious to know if this could be reproduced outside of > Chainguard's container image and in the official images? Based on what > you've said I suspect it would, but it would be good to confirm that > there aren't other modifications taking place. > > > > > > > I have reached out to FreeRDP, but they mentioned that it is a guacamole bug > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fguacamole-server%2Fblob%2Fd3b7828977c63a5b197158d6cbbdaf1846b579fb%2Fsrc%2Fprotocols%2Frdp%2Frdp.c%23L197&data=05%7C02%7CKeiko.Hashizume%40lexisnexisrisk.com%7C0fc2543e67c6402b88c808df0aae5372%7C9274ee3f94254109a27f9fb15c10675d%7C0%7C0%7C639241416022038102%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=BULOxYCjM62peyoCEiCxPcI9AcH2LVEhpoVXfv5IOZQ%3D&reserved=0<https://github.com/apache/guacamole-server/blob/d3b7828977c63a5b197158d6cbbdaf1846b579fb/src/protocols/rdp/rdp.c#L197><https://github.com/apache/guacamole-server/blob/d3b7828977c63a5b197158d6cbbdaf1846b579fb/src/protocols/rdp/rdp.c#L197>; > > is in PreConnect callback - something that was never supported (or done in > > any of the reference clients) > > Thanks, that could be useful in tracking it down. > > -Nick > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > > ________________________________ > The information contained in this e-mail message is intended only for the > personal and confidential use of the recipient(s) named above. This message > may be an attorney-client communication and/or work product and as such is > privileged and confidential. If the reader of this message is not the > intended recipient or an agent responsible for delivering it to the intended > recipient, you are hereby notified that you have received this document in > error and that any review, dissemination, distribution, or copying of this > message is strictly prohibited. If you have received this communication in > error, please notify us immediately by e-mail, and delete the original > message. > This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient. Any review, use, distribution, or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message. WARNING: Although the company has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments WesDx Limited Registered Office: 71-75 Shelton Street London WC2H 9JQ. Registered in England and Wales. Registered Number 12524165. WesDx.com<http://www.wesdx.com/>
