# CVE-2026-121388: FreeRDP uncontrolled memory allocation in DRDYNVC DATA_FIRST

Source: https://junglewise.ai/threats/cve-2026-121388-freerdp-from-3-0-0-before-3-32-2-contains-an-uncontrolled  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121388 · Severity: medium · CVSS 6.5 · Published 2026-11-03

FreeRDP is an open-source Remote Desktop Protocol client used to connect to Windows servers and other RDP-enabled systems. A malicious or compromised RDP server can force a client to allocate up to 4 GB of memory by declaring excessively large data fragments, causing the client to run out of memory and become unresponsive or crash. An attacker controlling a server could exploit this to deny service to users connecting via FreeRDP.

Technologies: [FreeRDP Project FreeRDP](https://junglewise.ai/threats/technologies/freerdp-project-freerdp). Vendors: [FreeRDP Project](https://junglewise.ai/threats/vendors/freerdp-project).

## Quick answers

**Is CVE-2026-121388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121388 being exploited in the wild.

**How severe is CVE-2026-121388?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** FreeRDP Project FreeRDP 3.0.0 through 3.32.1.

**Is there a fix for CVE-2026-121388?** Yes: fixed in 3.32.2. Until then: Reject DRDYNVC DATA_FIRST messages declaring lengths above a conservative per-message limit before calling StreamPool_Take, and implement per-channel and per-session memory reservation budgets to cap total allocation across multiple dynamic channels. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121388 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121388?** Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.2

Reject DRDYNVC DATA_FIRST messages declaring lengths above a conservative per-message limit before calling StreamPool_Take, and implement per-channel and per-session memory reservation budgets to cap total allocation across multiple dynamic channels.

## Technical details

The DRDYNVC (Dynamic Virtual Channel) handler in FreeRDP accepts a 32-bit length field from the RDP server in DATA_FIRST PDUs and passes it directly to StreamPool_Take before validating the actual message body. StreamPool_Take preallocates the declared amount of memory via calloc even though subsequent fragments may never arrive or may be smaller, allowing an attacker to exhaust client address space. The vulnerability affects versions 3.0.0 through 3.32.1 and requires an established RDP connection with DRDYNVC negotiated and at least one dynamic channel active.

## Affected products

- FreeRDP Project FreeRDP 3.0.0 through 3.32.1

## Timeline

- 2026-10-19: disclosed
- 2026-11-03: advisory

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp)
- [https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first](https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first)

## Related threats

- [FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in)
- [FreeRDP use-after-free in DRDYNVC tracker race condition](https://junglewise.ai/threats/cve-2026-121961-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in)
- [FreeRDP infinite loop in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-121959-freerdp-before-3-32-2-contains-an-infinite-loop-vulnerability-in)
- [FreeRDP server denial of service in RDP peer input parsing](https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing)
- [FreeRDP NULL pointer dereference in RDPGFX ResetGraphics](https://junglewise.ai/threats/cve-2026-121402-freerdp-before-3-32-2-contains-a-null-pointer-dereference)