DEBIAN-CVE-2026-121404: High severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDPWTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
Systems running a FreeRDP shadow server before 3.32.2 are exposed if authenticated RDP clients can connect and use opened audin or rdpgfx dynamic virtual channels. The listed Debian software entries are freerdp3 and freerdp2.
What access does an attacker need?
An attacker needs authenticated RDP client access to the shadow server. No user interaction is required after connection.
What is the practical impact of exploitation?
An attacker can send zero-length drdynvc DATA PDUs on opened audin or rdpgfx channels, causing server threads to spin because the messages are not consumed. This can consume full CPU cores until the client disconnects.
What mitigation is available if updating is not immediately possible?
The available data identifies authenticated RDP access and the audin or rdpgfx channels as required conditions. Restricting untrusted authenticated clients from connecting to the shadow server, or preventing access to those channels where operationally feasible, reduces exposure.