CVE-2026-121399: FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length

Q: Which systems are exposed to this issue?

FreeRDP clients that connect through an RD Gateway are exposed if they run a version before 3.32.2. The vulnerable packet handling occurs before tunnel authentication, so the gateway does not need to authenticate to trigger the allocation.

Q: What does an attacker need to do to exploit it?

An attacker needs to operate or impersonate a malicious RD Gateway that the FreeRDP client connects to. They can send an eight-byte RDG header with a declared packet length of 0x7FFFFFFF, causing the client to attempt a 2 GiB allocation.

Q: What is the practical impact?

Successful exploitation can exhaust memory on the client and cause a denial of service. The provided information does not indicate confidentiality or integrity impact.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdgreceivepacket that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

FreeRDP clients that connect through an RD Gateway are exposed if they run a version before 3.32.2. The vulnerable packet handling occurs before tunnel authentication, so the gateway does not need to authenticate to trigger the allocation.

What does an attacker need to do to exploit it?

An attacker needs to operate or impersonate a malicious RD Gateway that the FreeRDP client connects to. They can send an eight-byte RDG header with a declared packet length of 0x7FFFFFFF, causing the client to attempt a 2 GiB allocation.

What is the practical impact?

Successful exploitation can exhaust memory on the client and cause a denial of service. The provided information does not indicate confidentiality or integrity impact.

CVE-2026-121399: FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to do to exploit it?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to do to exploit it?

What is the practical impact?