{"id":"CVE-2026-121388","kind":"vulnerability","aliases":["CVE-2026-121388"],"related":[],"title":"FreeRDP: malicious RDP server can exhaust client memory via dynamic channel","description":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.","summary":"FreeRDP, a remote desktop client library, trusts a length field in DRDYNVC DATA_FIRST messages from the server and reserves up to about 4 GB before validating the body. A malicious RDP server can exhaust the memory of a connecting client, causing it to crash or stall.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","package","rdp","remote-desktop","windows"],"not_affected_if":["no-freerdp-client","version-3.32.2-or-later"],"how_to_check":"- Check the FreeRDP version in use, for example with `xfreerdp --version`, and see whether it is below `3.32.2`.\n- Find applications or packages that bundle FreeRDP, such as remote desktop clients or libraries that link it.","fix":"- Move FreeRDP to `3.32.2` or later.","status":"open","published_at":"2026-11-03T15:17:25+00:00","first_seen_at":"2026-11-03T15:21:57+00:00","triaged_at":"2026-11-03T15:23:07+00:00","updated_at":"2026-11-03T15:23:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:23:07Z","model":"claude-haiku-5-5","output":{"fix":"- Move FreeRDP to `3.32.2` or later.","reach":"network","title":"FreeRDP: malicious RDP server can exhaust client memory via dynamic channel","impact":"medium","summary":"FreeRDP, a remote desktop client library, trusts a length field in DRDYNVC DATA_FIRST messages from the server and reserves up to about 4 GB before validating the body. A malicious RDP server can exhaust the memory of a connecting client, causing it to crash or stall.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop","linux","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"malicious server crashes the client by exhausting its memory","analyst_note":"","how_to_check":"- Check the FreeRDP version in use, for example with `xfreerdp --version`, and see whether it is below `3.32.2`.\n- Find applications or packages that bundle FreeRDP, such as remote desktop clients or libraries that link it.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.32.2-or-later","no-freerdp-client"],"who_is_affected":"Any application built on FreeRDP from 3.0.0 up to but not including 3.32.2 is exposed when it connects to an RDP server. The risk is greatest for clients that connect to servers outside the organization's control. Systems using only a patched version or no FreeRDP client can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4216,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121388':14A,17A '-2026':13A,16A '294':108C '295':110C '3.0.0':75C '3.32.2':77C '4':49B,107C '967':109C 'alloc':82C,93C 'allow':85C 'attack':101C 'bodi':54B,123C 'byte':111C 'caus':67B,116C 'channel':11A,115C 'client':7A,30B,66B,92C,127C 'connect':65B 'contain':78C 'crash':70B 'cve':12A,15A 'data':38B,97C 'declar':103C 'desktop':24B,29B 'drdynvc':37B,96C 'dynam':10A,114C 'exhaust':6A,60B,126C 'field':35B,100C 'first':39B,98C 'forc':90C 'freerdp':1A,18B,26B,73C 'gb':50B 'larg':91C 'length':34B,99C,104C 'librari':31B 'linux':19B 'malici':2A,56B,86C 'memori':8A,62B,121C,128C 'messag':40B 'packag':20B 'rdp':3A,21B,57B,87C 'remot':23B,28B 'remote-desktop':22B 'reserv':45B,120C 'resourc':81C 'run':113C 'server':4A,43B,58B,88C 'stall':72B 'streampool':117C 'take':118C 'trust':32B 'uncontrol':80C 'valid':52B,124C 'via':9A 'vulner':83C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Any application built on FreeRDP from 3.0.0 up to but not including 3.32.2 is exposed when it connects to an RDP server. The risk is greatest for clients that connect to servers outside the organization's control. Systems using only a patched version or no FreeRDP client can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","linux","package","rdp","remotedesktop","windows"],"first_public_at":"2026-10-19T12:36:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121388","severity":null,"published_at":"2026-11-03T15:17:25+00:00","modified_at":"2026-11-03T15:17:26+00:00","first_seen_at":"2026-11-03T15:21:57+00:00","fetched_at":"2026-11-03T15:21:57+00:00","note":null}],"documents":[{"id":58299,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:36:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58300,"url":"https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}