CVE-2026-121400: FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
Published Nov 3, 2026
·Updated
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.
Affected Software
6 affected componentsFixes available
FreeRDP freerdp<3.32.2
debian/freerdp2*
debian/freerdp3*
debian/freerdp3<3.32.2+dfsg-1
3.32.2+dfsg-1
debian/freerdp2<=2.11.7+dfsg1-6~deb12u1
debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3
3.32.2+dfsg-13.33.0+dfsg-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Nov 3, 2026
CVE Published
via MITRE·02:28 PM
Data Sourced
via MITRE·02:28 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeaknessAffected Software