HIGH 7.1 NVD
CVE-2026-121400
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sendi
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.
Affected Products
- freerdp/freerdp
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4x6-2hrm-hvq9
- https://www.vulncheck.com/advisories/freerdp-before-3.32.2-cpu-exhaustion-via-rdg-control-
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-03 via NVD. Affected: freerdp/freerdp.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.