CVE-2026-121400 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical denial-of-service flaw located within the Remote Desktop Gateway protocol handling logic, specifically inside the rdg_process_control_packet function. This issue stems from an insufficient validation of packet lengths and incomplete data reception during the RDG tunnel-open exchange phase. When a malicious remote server acts as an adversary in this context, it can exploit the client's expectation for complete control packets by initiating a connection sequence that appears legitimate but ultimately fails to deliver the expected payload structure. The core technical flaw involves the handling of packet headers where the length field is set to 0xFFFF, indicating a large data body should follow, yet no such body is transmitted. This discrepancy triggers an unbounded read loop within the client application, causing it to continuously attempt reading from the socket without progress or timeout mechanisms effectively breaking the cycle under normal conditions.
From a technical perspective, this vulnerability exploits the asynchronous nature of network I/O operations in FreeRDP's implementation. The rdg_process_control_packet function is designed to parse control packets sent over the RD Gateway tunnel. When it encounters a header specifying a packet length that exceeds available data and lacks proper boundary checks or timeout logic for partial reads, it enters a tight loop spinning on read system calls. This behavior results in one client thread consuming maximum CPU resources indefinitely. The attack vector requires the adversary to complete the initial RDG tunnel-open exchange successfully, establishing trust and connection state before delivering the malformed packet header. Once this condition is met, the client becomes unresponsive due to resource exhaustion, effectively rendering it unusable for any remote desktop operations until the process is manually terminated or crashes.
The operational impact of this vulnerability is severe in environments relying on FreeRDP for secure remote access through gateways. A successful exploitation leads to a complete denial of service against the affected client system by exhausting computational resources rather than memory, which can cause cascading failures if other processes depend on available CPU cycles. This type of attack does not require authentication bypass or code execution privileges; it relies solely on network-level interaction with a compromised or malicious RD Gateway server. In enterprise settings where FreeRDP is used extensively for remote work infrastructure, such an incident could disrupt productivity and potentially mask more sophisticated attacks by overwhelming security monitoring tools that rely on system responsiveness.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption within a single execution path, as well as CWE-20 regarding improper input validation where the application fails to verify that received data matches expected structural constraints. In terms of offensive cybersecurity frameworks, this exploit maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under subcategories involving resource exhaustion via service disruption. The lack of robust timeout handling and length verification in network protocol parsers is a common pattern that leads to such stability issues across many remote access applications.
Mitigation strategies primarily involve upgrading FreeRDP to version 3.32.2 or later, where the rdg_process_control_packet function has been patched to include proper bounds checking and timeout mechanisms for partial reads. Administrators should also enforce strict network segmentation policies to limit exposure of RD Gateway endpoints to untrusted networks. Additionally, implementing intrusion detection systems capable of identifying anomalous packet patterns, such as headers with maximum length values followed by immediate connection closure or silence, can help detect attempted exploitation in real-time. Regular patch management and vulnerability scanning are essential to maintain the integrity of remote access infrastructure against these types of protocol-level abuse scenarios.