CVE-2026-121388 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical uncontrolled resource allocation flaw within the Remote Desktop Protocol implementation. This specific weakness is rooted in how the application handles dynamic virtual channels, particularly during the processing of DRDYNVC DATA_FIRST packets. In standard RDP operations, clients and servers negotiate channel parameters and allocate necessary resources to handle data streams. However, the vulnerability arises because the client side accepts a length value from the server's initial packet without performing adequate validation or bounds checking before initiating memory allocation. This design flaw allows an attacker controlling a malicious RDP server to dictate exactly how much memory the FreeRDP client will attempt to reserve for processing incoming data.
The technical mechanism of this exploit relies on the DRDYNVC protocol extension, which facilitates dynamic channel creation and management during an RDP session. When a DATA_FIRST packet is received, it contains a Length field that specifies the size of the subsequent data body. The vulnerability exists because the StreamPool_Take function, responsible for allocating memory buffers within the client's stream pool, proceeds to reserve space based on this untrusted input value before any validation of the actual payload occurs. An attacker can craft a malicious packet with a maximum integer value in the Length field, specifically 4,294,967,295 bytes, which corresponds to the unsigned 32-bit integer limit. By sending such a request, the client attempts to allocate nearly four gigabytes of memory immediately upon receipt of this header information.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through resource exhaustion. Since the allocation happens before body validation, the application commits significant system resources based solely on the malicious length declaration. If the client machine does not have sufficient available RAM to satisfy such a massive request, the operating system may terminate the FreeRDP process due to out-of-memory conditions. Even if partial allocation succeeds or swap space is utilized heavily, the performance degradation can be substantial enough to render the remote session unusable for legitimate users. This effectively allows any malicious RDP server connected to an affected client to crash the application or destabilize the host system without requiring authentication or further interaction from the user beyond establishing a connection.
From a classification perspective, this vulnerability aligns with CWE-789, which describes uncontrolled memory allocation leading to resource exhaustion. It also maps closely to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via application layer flooding or resource consumption attacks. The lack of input validation on network-received data structures is a common pattern in legacy protocol implementations where performance optimizations sometimes bypassed rigorous security checks for speed. In this case, the assumption that length fields are trustworthy proved incorrect when facing adversarial inputs designed to abuse system limits.
Mitigation strategies must focus primarily on updating the FreeRDP software stack to version 3.32.2 or later, as these releases include patches that enforce proper validation of stream lengths prior to memory allocation. Administrators should ensure that all client endpoints running RDP sessions are updated promptly to prevent exploitation by malicious servers encountered in untrusted networks. Additionally, implementing network-level authentication and restricting RDP access to known, trusted server IPs can reduce the attack surface. For environments where immediate patching is not feasible, deploying intrusion detection systems capable of identifying anomalous packet sizes or excessive memory allocation patterns may provide a layer of defense against such resource exhaustion attempts until the underlying software defect is resolved.