CVE-2026-121412: FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATAFIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions from 3.0.0 through versions before 3.32.2 are affected when the proxy processes intercepted Dynamic Virtual Channel (DVC) messages. Connected clients can trigger the condition.
What access does an attacker need?
An attacker needs privileges to connect as a client to the affected proxy. No user interaction is required, and exploitation can be performed over the network.
What is the operational impact?
A malicious client can declare a large DATA_FIRST message length and continue sending incomplete fragments, retaining heap memory proportional to the traffic sent. This can exhaust proxy memory and degrade or deny service.
What version resolves the issue?
Upgrade FreeRDP to version 3.32.2 or later. The affected range is 3.0.0 before 3.32.2.