{"id":"CVE-2026-121412","kind":"vulnerability","aliases":["CVE-2026-121412"],"related":[],"title":"FreeRDP: proxy memory grows unbounded, letting clients degrade service","description":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.","summary":"FreeRDP's proxy component can be made to hold on to heap memory when a connected client declares a large DVC message and never finishes sending it. An attacker can grow proxy memory with traffic and degrade or take down the service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","package","remote-desktop","self-hosted"],"not_affected_if":["no-proxy-deployed","versions-3.32.2-or-later"],"how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it with the fixed range below.\n- Confirm whether the FreeRDP proxy component is deployed and reachable by untrusted clients.","fix":"- FreeRDP: move to `3.32.2` or later (fixed in 3.x from `3.32.2`; the sources give no fix for earlier branches).","status":"open","published_at":"2026-11-03T15:17:30+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","triaged_at":"2026-11-03T15:22:58+00:00","updated_at":"2026-11-03T15:22:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:22:58Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later (fixed in 3.x from `3.32.2`; the sources give no fix for earlier branches).","reach":"network","title":"FreeRDP: proxy memory grows unbounded, letting clients degrade service","impact":"low","summary":"FreeRDP's proxy component can be made to hold on to heap memory when a connected client declares a large DVC message and never finishes sending it. An attacker can grow proxy memory with traffic and degrade or take down the service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freerdp","remote-desktop","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"proxy memory exhausted, service degraded or stopped","analyst_note":"","how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it with the fixed range below.\n- Confirm whether the FreeRDP proxy component is deployed and reachable by untrusted clients.","plain_action":"","needs_analyst":false,"not_affected_if":["no-proxy-deployed","versions-3.32.2-or-later"],"who_is_affected":"Only systems running the FreeRDP proxy from 3.0.0 before 3.32.2 that accept connections from untrusted clients are exposed. Plain FreeRDP clients and deployments without the proxy are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4201,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121412':12A,15A '-2026':11A,14A '3.0.0':68C '3.32.2':70C 'attack':52B,92C 'client':7A,40B,83C 'complet':105C 'compon':27B 'connect':39B,82C 'consumpt':75C 'contain':71C 'cve':10A,13A 'data':97C 'declar':41B,94C 'degrad':8A,60B,115C 'desktop':20B 'dvc':44B,89C 'finish':48B 'first':98C 'fragment':103C 'freerdp':1A,16B,24B,66C 'grow':4A,54B,108C 'heap':35B,85C 'hold':32B 'host':23B 'intercept':88C 'keep':101C 'larg':43B,96C 'length':99C 'let':6A,81C 'made':30B 'memori':3A,36B,56B,86C,110C 'messag':45B,90C,107C 'never':47B 'packag':17B 'proport':111C 'proxi':2A,26B,55B,79C,109C 'reassembl':91C 'remot':19B 'remote-desktop':18B 'resourc':74C 'retain':84C 'self':22B 'self-host':21B 'send':49B,102C 'servic':9A,65B,116C 'take':62B 'traffic':58B,113C 'unbound':5A 'uncontrol':73C 'via':87C 'vulner':76C 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Only systems running the FreeRDP proxy from 3.0.0 before 3.32.2 that accept connections from untrusted clients are exposed. Plain FreeRDP clients and deployments without the proxy are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","package","remotedesktop","selfhosted"],"first_public_at":"2026-10-19T12:07:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121412","severity":null,"published_at":"2026-11-03T15:17:30+00:00","modified_at":"2026-11-03T15:17:30+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","fetched_at":"2026-11-03T15:21:58+00:00","note":null}],"documents":[{"id":58347,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:07:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58348,"url":"https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-proxy-memory-exhaustion-via-dvc-reassembly","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}