Live › vulnerability › CVE-2026-121412
FreeRDP's proxy component can be made to hold on to heap memory when a connected client declares a large DVC message and never finishes sending it. An attacker can grow proxy memory with traffic and degrade or take down the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Only systems running the FreeRDP proxy from 3.0.0 before 3.32.2 that accept connections from untrusted clients are exposed. Plain FreeRDP clients and deployments without the proxy are not described as affected.
No product ranges from the sources yet.
xfreerdp /version, and compare it with the fixed range below.3.32.2 or later (fixed in 3.x from 3.32.2; the sources give no fix for earlier branches).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.
This page as .md · .json · in your agent: get_signal("CVE-2026-121412")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.