DEBIAN-CVE-2026-121400: High severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
FreeRDP clients that connect to an attacker-controlled or malicious RD Gateway are exposed. The issue affects FreeRDP versions before 3.32.2, including the listed Debian freerdp2 and freerdp3 packages.
What must an attacker do to trigger the issue?
The attacker must operate or control an RD Gateway and complete the RDG tunnel-open exchange with the client. They then send an eight-byte control-packet header declaring a packet length of 0xFFFF and withhold the packet body.
What is the impact on an affected client?
The malformed incomplete keepalive control packet causes an unbounded read loop with no progress. One client thread can spin at full CPU, resulting in a denial of service.