Uncontrolled Resource Allocation Vulnerability in FreeRDP by FreeRDP
CVE-2026-121388

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121388?

FreeRDP versions 3.0.0 through 3.32.1 have a vulnerability that allows malicious RDP servers to exploit the DRDYNVC DATA_FIRST Length field. By declaring excessively large lengths (up to 4,294,967,295 bytes), attackers can force the client to reserve an excessive amount of memory before any body validation occurs. This flaw can lead to memory exhaustion on the client side, disrupting services and affecting the overall performance.

Affected Version(s)

FreeRDP 3.0.0 < 3.32.2

FreeRDP 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iPlayForSG
.