{"id":"CVE-2026-121404","kind":"vulnerability","aliases":["CVE-2026-121404"],"related":[],"title":"FreeRDP: authenticated clients can exhaust server CPU via empty RDP messages","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.","summary":"FreeRDP's shadow server, which lets remote desktop clients view and control a machine, can be made to spin server threads by an authenticated client sending zero-length drdynvc DATA messages. The attacker can consume full CPU cores until the client disconnects, causing denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","rdp","runtime","self-hosted"],"not_affected_if":["auth-required","no-shadow-server","rdp-not-exposed"],"how_to_check":"- Check the installed FreeRDP version with `xfreerdp --version` or your package manager, and compare it to the fixed version below.\n- Confirm whether you run the FreeRDP shadow server (`freerdp-shadow-cli` or a shadow-based remote desktop service); unknown if the sources say how to detect it otherwise.","fix":"- FreeRDP: move to `3.32.2` or later.","status":"open","published_at":"2026-11-03T15:17:28+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","triaged_at":"2026-11-03T15:23:02+00:00","updated_at":"2026-11-03T15:23:02+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T15:23:02Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later.","reach":"network","title":"FreeRDP: authenticated clients can exhaust server CPU via empty RDP messages","impact":"medium","summary":"FreeRDP's shadow server, which lets remote desktop clients view and control a machine, can be made to spin server threads by an authenticated client sending zero-length drdynvc DATA messages. The attacker can consume full CPU cores until the client disconnects, causing denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freerdp","rdp","self-hosted","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated client exhausts server CPU cores, causing denial of service","analyst_note":"","how_to_check":"- Check the installed FreeRDP version with `xfreerdp --version` or your package manager, and compare it to the fixed version below.\n- Confirm whether you run the FreeRDP shadow server (`freerdp-shadow-cli` or a shadow-based remote desktop service); unknown if the sources say how to detect it otherwise.","plain_action":"","needs_analyst":false,"not_affected_if":["no-shadow-server","rdp-not-exposed","auth-required"],"who_is_affected":"Only servers running the FreeRDP shadow server, which shares an existing desktop over RDP, are exposed according to the sources. An attacker needs valid RDP credentials and an open session, so systems that do not run shadow sessions or do not accept RDP from untrusted users are lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4209,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121404':14A,17A '-2026':13A,16A '3.32.2':74C 'allow':86C 'attack':58B,102C 'audin':110C 'authent':2A,48B,87C 'caus':68B 'channel':113C 'client':3A,33B,49B,66B,89C 'consum':60B,119C,121C 'contain':75C 'control':36B 'core':63B,124C 'cpu':7A,62B,123C 'cve':12A,15A 'data':55B,100C,106C 'denial':69B,77C 'desktop':32B 'disconnect':67B,126C 'drdynvc':54B,99C 'empti':9A,105C 'exhaust':5A 'freerdp':1A,18B,25B,72C,116C 'full':61B,122C 'host':24B 'length':53B,98C 'let':30B 'linux':19B 'machin':38B 'made':41B 'messag':11A,56B,107C 'never':118C 'open':109C 'pdus':101C 'rdp':10A,20B,88C 'rdpgfx':112C 'remot':31B 'runtim':21B 'self':23B 'self-host':22B 'send':50B,95C,104C 'server':6A,28B,44B,84C,92C 'servic':71B,79C 'shadow':27B,83C 'spin':43B,91C 'thread':45B,93C 'via':8A 'view':34B 'vulner':80C 'wtsvirtualchannelread':117C 'zero':52B,97C 'zero-length':51B,96C","nicknames":[],"mitigations":[],"who_affected":"Only servers running the FreeRDP shadow server, which shares an existing desktop over RDP, are exposed according to the sources. An attacker needs valid RDP credentials and an open session, so systems that do not run shadow sessions or do not accept RDP from untrusted users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","linux","rdp","runtime","selfhosted"],"first_public_at":"2026-10-19T12:33:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121404","severity":null,"published_at":"2026-11-03T15:17:28+00:00","modified_at":"2026-11-03T15:17:29+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","fetched_at":"2026-11-03T15:21:58+00:00","note":null}],"documents":[{"id":58331,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:33:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58332,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}