Live › vulnerability › CVE-2026-121404
FreeRDP's shadow server, which lets remote desktop clients view and control a machine, can be made to spin server threads by an authenticated client sending zero-length drdynvc DATA messages. The attacker can consume full CPU cores until the client disconnects, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Only servers running the FreeRDP shadow server, which shares an existing desktop over RDP, are exposed according to the sources. An attacker needs valid RDP credentials and an open session, so systems that do not run shadow sessions or do not accept RDP from untrusted users are lower risk.
No product ranges from the sources yet.
xfreerdp --version or your package manager, and compare it to the fixed version below.freerdp-shadow-cli or a shadow-based remote desktop service); unknown if the sources say how to detect it otherwise.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
This page as .md · .json · in your agent: get_signal("CVE-2026-121404")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.