FreeRDP
CVE-2026-121404: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending ze
CVE-2026-121404 Nov 3, 2026 Source: Vendor
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-121404
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3 matching , clear filters
CVE-2026-121404
BR2026-0000-041593
unclaimed
Credited as Kushalkhemka
CVE-2026-121404
BR2026-0000-041594
unclaimed
Credited as mayank-jangid-moon
CVE-2026-121404
BR2026-0000-041595
unclaimed
Credited as skigeek16