CVE-2026-121399

The record

FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
• CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
• CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
• CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770
• CVE-2026-115716 Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to… CWE-770
• CVE-2026-118487 In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in… CWE-770
• CVE-2026-108147 An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13… CWE-770
• CVE-2026-121412 FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption… CWE-770