Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121404FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 67.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-devel2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-libs2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-server2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10libwinpr2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10libwinpr-devel2:3.32.2-1.el10_2ALSA-2026:94514
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-121404
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-121404
Debian:14freerdp33.32.2+dfsg-1DEBIAN-CVE-2026-121404
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-121404
Ubuntu:24.04:LTSfreerdp3no fix listedUBUNTU-CVE-2026-121404
Ubuntu:26.04:LTSfreerdp3no fix listedUBUNTU-CVE-2026-121404
Ubuntu:26.10freerdp3no fix listedUBUNTU-CVE-2026-121404

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 0 – before 3.32.2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References