DEBIAN-CVE-2026-121412: High severity debian/freerdp2 vulnerability
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATAFIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the FreeRDP proxy with intercepted Dynamic Virtual Channel (DVC) message reassembly are exposed. The affected FreeRDP version range is 3.0.0 before 3.32.2.
What access does an attacker need to exploit it?
An attacker needs to be a connected client of the proxy. They can declare a large DATA_FIRST message length and continue sending fragments without completing the message.
What is the practical impact of exploitation?
Proxy heap memory can grow in proportion to attacker-supplied traffic, degrading service availability. The provided severity vector indicates no impact to confidentiality or integrity, with availability affected.
How can I determine whether I may be affected?
Check whether the deployed FreeRDP proxy performs intercepted DVC message reassembly and whether its FreeRDP version is 3.0.0 through a version earlier than 3.32.2. Monitor proxy memory growth associated with clients that send incomplete DVC messages.