---
id: "CVE-2026-121412"
kind: "vulnerability"
aliases: ["CVE-2026-121412"]
title: "FreeRDP: proxy memory grows unbounded, letting clients degrade service"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["freerdp", "package", "remote-desktop", "self-hosted"]
not_affected_if: ["no-proxy-deployed", "versions-3.32.2-or-later"]
published_at: "2026-11-03T15:17:30+00:00"
first_seen_at: "2026-11-03T15:21:58+00:00"
updated_at: "2026-11-03T15:22:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121412", "first_seen_at": "2026-11-03T15:21:58+00:00"}]
---

# FreeRDP: proxy memory grows unbounded, letting clients degrade service

FreeRDP's proxy component can be made to hold on to heap memory when a connected client declares a large DVC message and never finishes sending it. An attacker can grow proxy memory with traffic and degrade or take down the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it with the fixed range below.
- Confirm whether the FreeRDP proxy component is deployed and reachable by untrusted clients.

## Fix

- FreeRDP: move to `3.32.2` or later (fixed in 3.x from `3.32.2`; the sources give no fix for earlier branches).

## Timeline

- 2026-11-03T15:21:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121412

## Documents

- [advisory] Vendor advisory: github.com https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-proxy-memory-exhaustion-via-dvc-reassembly

## From the sources

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_