Live › vulnerability › CVE-2026-121399
FreeRDP before 3.32.2 mishandles an RD Gateway packet length field in rdg_receive_packet, so a malicious gateway can make the client allocate 2 GiB before tunnel authentication. An attacker gets pre-authentication memory exhaustion and denial of service against the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Systems running a FreeRDP client that connects through an RD Gateway, including embedded or bundled copies in other products. Exposure requires connecting to a gateway an attacker controls or can impersonate, since the flaw is triggered before tunnel authentication. Direct RDP connections without a gateway are not described as affected.
No product ranges from the sources yet.
xfreerdp /version or the package manager's version query3.32.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-121399")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.