CVE-2026-121404: FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

Q: Which deployments are exposed?

FreeRDP shadow server deployments running a version before 3.32.2 are affected. Exposure requires clients to be able to authenticate to the RDP service and use opened audin or rdpgfx dynamic virtual channels.

Q: What access does an attacker need?

An attacker needs valid RDP authentication but does not need user interaction. They can send zero-length drdynvc DATA PDUs after the relevant channels have been opened.

Q: What is the operational impact?

The issue can cause server threads to spin because the empty messages are not consumed by FreeRDP_WTSVirtualChannelRead. This can consume full CPU cores until the attacking client disconnects.

Q: How can I determine whether a system is affected?

Confirm whether the deployment uses the FreeRDP shadow server and is running a FreeRDP release before 3.32.2. Systems not exposing the shadow server are not identified as affected by the provided information.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDPWTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed?

FreeRDP shadow server deployments running a version before 3.32.2 are affected. Exposure requires clients to be able to authenticate to the RDP service and use opened audin or rdpgfx dynamic virtual channels.

What access does an attacker need?

An attacker needs valid RDP authentication but does not need user interaction. They can send zero-length drdynvc DATA PDUs after the relevant channels have been opened.

What is the operational impact?

The issue can cause server threads to spin because the empty messages are not consumed by FreeRDP_WTSVirtualChannelRead. This can consume full CPU cores until the attacking client disconnects.

How can I determine whether a system is affected?

Confirm whether the deployment uses the FreeRDP shadow server and is running a FreeRDP release before 3.32.2. Systems not exposing the shadow server are not identified as affected by the provided information.

CVE-2026-121404: FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What is the operational impact?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What is the operational impact?

How can I determine whether a system is affected?