CVE-2026-121399 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical resource management flaw within the Remote Desktop Gateway (RDG) client implementation, specifically located in the rdg_receive_packet function. This issue stems from an insufficient validation of packet length fields received during the initial stages of connection establishment. When a client initiates communication with an RD Gateway, it processes incoming headers to determine how much memory must be allocated for subsequent data processing. In this specific scenario, the application fails to adequately verify that the declared packet size is reasonable or within expected bounds before proceeding with memory allocation operations. This lack of pre-allocation validation allows an attacker who controls a malicious RD Gateway server to manipulate the client's resource consumption significantly earlier in the connection lifecycle than intended by the protocol design.
The technical mechanism of this exploitation involves sending a specially crafted eight-byte RDG header that declares a packet length value of 0x7FFFFFFF, which corresponds to approximately two gigabytes minus one byte. Upon receiving this malicious header, the FreeRDP client attempts to allocate memory for this massive buffer before any authentication or tunneling security checks have been performed. This pre-authentication allocation is particularly dangerous because it occurs during the initial handshake phase where trust has not yet been established between the client and server. The immediate consequence of triggering this code path is severe local resource exhaustion on the victim's machine, leading to a denial of service condition as the system struggles to fulfill the excessive memory request or fails entirely due out-of-memory errors.
From an operational impact perspective, this vulnerability enables remote attackers to disrupt availability for users relying on FreeRDP for remote desktop access without requiring any valid credentials. Since the attack vector targets pre-authentication logic, it bypasses traditional security controls that rely on user authentication status. This makes the exploit highly effective against unpatched systems and potentially difficult to detect using standard intrusion detection signatures that focus on post-login activity. The impact extends beyond simple application crashes; sustained attempts can degrade system performance for other processes sharing memory resources or cause complete host instability depending on available swap space and kernel-level out-of-memory handling configurations.
This flaw aligns with CWE-789, which classifies the issue as a Memory Allocation with Excessive Size, highlighting the failure to restrict resource consumption based on untrusted input size parameters. Furthermore, in terms of tactical classification within the MITRE ATT&CK framework, this vulnerability facilitates Denial of Service (T1499) by exhausting system resources and potentially serves as an initial vector for further exploitation if combined with other vulnerabilities that allow code execution following memory corruption or instability events. The attack pattern also reflects CWE-20 Improper Input Validation, specifically the failure to validate data integrity before processing critical operations like memory allocation.
Mitigation strategies primarily involve upgrading FreeRDP to version 3.32.2 or later where this logic has been corrected to enforce strict bounds checking on packet lengths prior to any buffer allocation. Organizations should also implement network-level access controls to restrict connections from untrusted RD Gateway servers and monitor for anomalous memory usage spikes in client processes during the initial connection phase. Additionally, deploying intrusion prevention systems capable of detecting abnormal RDP traffic patterns can provide an additional layer of defense against such pre-authentication exploitation attempts until all endpoints are fully patched.