Is CVE-2026-121400 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121400 being exploited in the wild.

How severe is CVE-2026-121400?

Medium severity, with a CVSS score of 6.5, published 3 November 2026.

Is there a fix for CVE-2026-121400?

Yes: fixed in 3.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121400 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121400?

Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121400: FreeRDP CPU exhaustion in RD Gateway packet handler

CVE-2026-121400 · Severity: medium · CVSS 6.5 · Published 2026-11-03

FreeRDP is a remote desktop client used to connect to Windows systems and RD Gateways. A malicious RD Gateway can exhaust the client's CPU by sending a specially crafted control packet with incomplete data, causing the client to spin at 100% CPU utilization on a single thread until manually stopped. This creates a denial-of-service condition that makes the client machine unresponsive.

Technologies: FreeRDP. Vendors: FreeRDP.

Quick answers

Is CVE-2026-121400 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121400 being exploited in the wild.
How severe is CVE-2026-121400?: Medium severity, with a CVSS score of 6.5, published 3 November 2026.
Which products and versions are affected?: FreeRDP before 3.32.2.
Is there a fix for CVE-2026-121400?: Yes: fixed in 3.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121400 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121400?: Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.32.2

Technical details

The vulnerability is an infinite loop (CWE-835) in rdg_process_control_packet when handling RD Gateway control packets. After completing the RDG tunnel-open exchange, an attacker sends an eight-byte keepalive header with packetLength=0xFFFF and withholds the body payload. The vulnerable code retries rdg_socket_read whenever BIO_should_retry returns true with no wait, backoff, or iteration limit, causing an unbounded no-progress read loop that spins one client thread at full CPU until user-requested abort is processed.

Affected products

FreeRDP FreeRDP before 3.32.2

Timeline

2026-10-19: disclosed
2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.