UBUNTU-CVE-2026-121404: High severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDPWTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated RDP client connected to a FreeRDP shadow server can exploit it. The client must be able to use an already opened audin or rdpgfx dynamic virtual channel.

What is the operational impact of exploitation?

A malicious client can repeatedly send zero-length drdynvc DATA PDUs that are not consumed by FreeRDP_WTSVirtualChannelRead. This can cause server threads to spin and consume full CPU cores until the client disconnects.

Are systems affected if they do not use the FreeRDP shadow server?

The described vulnerable component is the FreeRDP shadow server. The provided information does not indicate exposure for FreeRDP installations that do not run that server.

What configuration or access controls can reduce risk before updating?

Limit access to the shadow server to trusted authenticated RDP clients and restrict use of the audin and rdpgfx channels where operationally feasible. Disconnect clients that cause sustained unexpected CPU consumption.

How can administrators identify possible active exploitation?

Look for FreeRDP shadow-server threads consuming full CPU cores while affected RDP clients remain connected. The condition may persist until the offending client disconnects.

UBUNTU-CVE-2026-121404: High severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of exploitation?

Are systems affected if they do not use the FreeRDP shadow server?

What configuration or access controls can reduce risk before updating?

How can administrators identify possible active exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of exploitation?

Are systems affected if they do not use the FreeRDP shadow server?

What configuration or access controls can reduce risk before updating?

How can administrators identify possible active exploitation?