Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-121400

FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that…

Risk score
44/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
3 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withho…
Affected
Freerdp before 3.32.2
Fix
Upgrade Freerdp to 3.32.2 or later.
Exploitation
No known exploitation

Story map

Story map: FreerdpTHE FLAWSTHE FIXCVE-2026-121400FreeRDP before 3.32.2contains a denial-of-servicevulnerability in…CVSS 6.5 · EPSS 0%CVE-2026-109257Double free can lead to denialof serviceCVSS 7.5 · EPSS 0%CVE-2026-109676Use-after-free can lead todenial of serviceCVSS 8.8 · EPSS 0%CVE-2026-110838Missing authenticationCVSS 7.5 · EPSS 0%Upgrade Freerdp3.32.2 · 3.32.0or later on your release lineWho is exposedFreerdp before 3.32.0AMBER · PATCH THIS WEEKFreerdpFreeRDP before 3.32.0 containsa double-free vulnerability innsc_context_initialize_encode()that leaves dangling planepointers after a partial buffergrowth failure. Attackers usinga crafted RDP client can…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-835 (CWE-835)73 other warnings in 30 days →Same productEarlier Freerdp warnings84 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…

The flaws

  • CVE-2026-121400: FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that… (CVSS 6.5 · EPSS 0%)
  • CVE-2026-109257: Double free can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109676: Use-after-free can lead to denial of service (CVSS 8.8 · EPSS 0%)
  • CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.2 · 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.

Last activity 3 Nov 2026. Patch Forecast updates every hour.