CVE-2026-121404 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in versions of FreeRDP prior to 3.32.2 represents a significant denial of service risk within the shadow server component of the Remote Desktop Protocol implementation. This flaw specifically targets authenticated clients who have established connections with the RDP server, allowing them to exploit improper handling of dynamic virtual channel data packets. The core technical issue lies in the processing logic for drdynvc DATA PDUs, which are used to transmit data over dynamically created channels such as audio input (audin) or graphics pipeline (rdpgfx). When an attacker sends zero-length or empty DATA messages on these open channels, the internal function FreeRDP_WTSVirtualChannelRead fails to properly consume or process them. This failure triggers a loop where server threads are continuously spun up and kept active in an attempt to handle the malformed input, leading to unbounded resource consumption.
From an operational perspective, this vulnerability results in severe performance degradation for the affected system. Because the server threads remain occupied processing these empty packets without termination or proper error handling, they consume full CPU cores until the connection is manually disconnected by an administrator or a timeout mechanism intervenes. This effectively renders the RDP service unusable for legitimate users and can lead to complete system unresponsiveness if multiple connections are exploited simultaneously. The impact aligns with CWE-400, which describes resources not being properly controlled, leading to resource exhaustion. Furthermore, this behavior is consistent with ATT&CK technique T1499, Endpoint Denial of Service, as it involves overwhelming a specific component or the entire endpoint through sustained computational load rather than crashing the application outright.
Mitigation strategies for this vulnerability primarily involve upgrading FreeRDP to version 3.32.2 or later, where the issue has been addressed by correcting the handling logic within the virtual channel read functions. Administrators should ensure that all RDP servers are patched promptly to prevent exploitation. In environments where immediate patching is not feasible, network-level access controls can be implemented to restrict who can connect as authenticated shadow clients. Additionally, monitoring for unusual CPU spikes associated with RDP services may help in detecting active attempts to exploit this flaw before total service disruption occurs.