Live › vulnerability › CVE-2026-121388
FreeRDP, a remote desktop client library, trusts a length field in DRDYNVC DATA_FIRST messages from the server and reserves up to about 4 GB before validating the body. A malicious RDP server can exhaust the memory of a connecting client, causing it to crash or stall.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Any application built on FreeRDP from 3.0.0 up to but not including 3.32.2 is exposed when it connects to an RDP server. The risk is greatest for clients that connect to servers outside the organization's control. Systems using only a patched version or no FreeRDP client can skip it.
No product ranges from the sources yet.
xfreerdp --version, and see whether it is below 3.32.2.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-121388")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.