DEBIAN-CVE-2026-121399: Medium severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdgreceivepacket that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients that connect to a malicious RD Gateway are exposed. The affected software entries are debian/freerdp3 and debian/freerdp2, and the issue affects FreeRDP versions before 3.32.2.
What does an attacker need to do to trigger the denial of service?
An attacker needs to operate or control the RD Gateway that a client connects to. The gateway can send an eight-byte RDG header declaring a packet length of 0x7FFFFFFF, causing the client to attempt a 2 GiB allocation before tunnel authentication.
How can I determine whether a system is affected?
Check the installed FreeRDP version. Versions earlier than 3.32.2 are affected by this allocation issue.