Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-121412

Freerdp: denial of service

Risk score
46/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.4%
Published
3 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memor…
Affected
Freerdp before 3.32.2
Fix
Upgrade Freerdp to 3.32.2 or later.
Exploitation
No known exploitation

Story map

Story map: FreerdpTHE FLAWSTHE FIXCVE-2026-121412Denial of serviceCVSS 6.5 · EPSS 0%CVE-2026-109257Double free can lead to denialof serviceCVSS 7.5 · EPSS 0%CVE-2026-109676Use-after-free can lead todenial of serviceCVSS 8.8 · EPSS 0%CVE-2026-110838Missing authenticationCVSS 7.5 · EPSS 0%Upgrade Freerdp3.32.2 · 3.32.0or later on your release lineWho is exposedFreerdp before 3.32.0AMBER · PATCH THIS WEEKFreerdpFreeRDP before 3.32.0 containsa double-free vulnerability innsc_context_initialize_encode()that leaves dangling planepointers after a partial buffergrowth failure. Attackers usinga crafted RDP client can…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-770)275 other warnings in 30 days →Same productEarlier Freerdp warnings84 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…

The flaws

The fix

Upgrade Freerdp: 3.32.2 · 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

Last activity 3 Nov 2026. Patch Forecast updates every hour.