DEBIAN-CVE-2026-121388: High severity debian/freerdp2 vulnerability
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATAFIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPoolTake to reserve memory before body validation and exhaust client memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients in the affected version range are exposed when they connect to a malicious RDP server that uses running dynamic channels. The listed Debian packages are freerdp3 and freerdp2.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that a user connects to. Exploitation requires user interaction because the client must initiate that RDP connection; no client privileges are required.
What is the impact of successful exploitation?
A malicious server can specify a DRDYNVC DATA_FIRST Length value as large as 4,294,967,295 bytes. The client may reserve memory before validating the message body, which can exhaust available client memory and cause a denial of service.