GHSA-rrp5-666j-g6gp: FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST
Published Nov 3, 2026
·Updated
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATAFIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPoolTake to reserve memory before body validation and exhaust client memory.
Event History
Nov 3, 2026
CVE Published
via OSV·02:27 PM
Data Sourced
via OSV·02:27 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need credentials or local access to exploit this?
No privileges are required on the vulnerable client. Exploitation requires a user to connect with FreeRDP to a malicious RDP server, which can send the crafted DRDYNVC DATA_FIRST message.
2
Which deployments are exposed?
FreeRDP clients from version 3.0.0 before 3.32.2 are affected. The vulnerable behavior is triggered while processing running dynamic channels from the connected RDP server.