CVE-2026-121399: FreeRDP memory exhaustion in RD Gateway packet handling

CVE-2026-121399 · Severity: medium · CVSS 4.3 · Published 2026-11-03

FreeRDP is a remote desktop client that connects to Windows servers via the RDP protocol. A malicious or compromised RD Gateway server can force the client to allocate approximately 2 gigabytes of memory before the secure tunnel is established, causing the client to exhaust available system memory and become unresponsive. An attacker with network access to a victim's connection path can trigger this denial-of-service condition with a single malformed network packet.

Technologies: FreeRDP Project FreeRDP. Vendors: FreeRDP Project.

Quick answers

Is CVE-2026-121399 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-121399 being exploited in the wild.
How severe is CVE-2026-121399?
Medium severity, with a CVSS score of 4.3, published 3 November 2026.
Which products and versions are affected?
FreeRDP Project FreeRDP before 3.32.2.
Is there a fix for CVE-2026-121399?
Yes: fixed in 3.32.2. Until then: Restrict network access to RD Gateway servers from untrusted sources. Apply firewall rules to limit RDP and RD Gateway traffic to trusted gateway servers only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121399 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-121399?
Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.32.2

Restrict network access to RD Gateway servers from untrusted sources. Apply firewall rules to limit RDP and RD Gateway traffic to trusted gateway servers only.

Technical details

The vulnerability exists in the rdg_receive_packet function, where a declared packet length of 0x7FFFFFFF passes an INT_MAX validation check but subsequently triggers Stream_EnsureCapacity to allocate and zero-fill approximately 2 GiB of memory before the packet body bytes are read. An attacker can send an eight-byte RDG header (02 00 00 00 ff ff ff 7f) over the network without authentication, causing pre-authentication memory exhaustion and denial of service. The attack is fixed in FreeRDP 3.32.2.

Affected products

  • FreeRDP Project FreeRDP before 3.32.2

Timeline

  • 2026-10-19: disclosed
  • 2026-11-03: advisory
  • 2026-11-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.