CVE-2026-121388: FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST

Q: Which systems should be prioritized for remediation?

Prioritize FreeRDP clients running versions from 3.0.0 up to, but not including, 3.32.2, particularly where they connect to untrusted or potentially malicious RDP servers.

Q: What must an attacker control to trigger the issue?

The attacker needs to operate or control a malicious RDP server that can send DRDYNVC DATA_FIRST messages on running dynamic channels. The crafted Length field can cause the client to reserve very large amounts of memory.

Q: What is the expected security impact?

The stated impact is client memory exhaustion and loss of availability. The supplied vector indicates no confidentiality or integrity impact.

Q: How can I determine whether an installation is affected?

Check the installed FreeRDP version. Versions before 3.32.2 are affected if they are 3.0.0 or later.

Published Nov 3, 2026

Updated

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATAFIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPoolTake to reserve memory before body validation and exhaust client memory.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems should be prioritized for remediation?

Prioritize FreeRDP clients running versions from 3.0.0 up to, but not including, 3.32.2, particularly where they connect to untrusted or potentially malicious RDP servers.

What must an attacker control to trigger the issue?

The attacker needs to operate or control a malicious RDP server that can send DRDYNVC DATA_FIRST messages on running dynamic channels. The crafted Length field can cause the client to reserve very large amounts of memory.

What is the expected security impact?

The stated impact is client memory exhaustion and loss of availability. The supplied vector indicates no confidentiality or integrity impact.

How can I determine whether an installation is affected?

Check the installed FreeRDP version. Versions before 3.32.2 are affected if they are 3.0.0 or later.

CVE-2026-121388: FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems should be prioritized for remediation?

What must an attacker control to trigger the issue?

What is the expected security impact?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for remediation?

What must an attacker control to trigger the issue?

What is the expected security impact?

How can I determine whether an installation is affected?