CVE-2026-121400

The record

FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.

Affected packages

Related vulnerabilities

• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-835
• CVE-2026-121261 A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. CWE-835
• CVE-2026-119738 The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService)… CWE-835
• CVE-2026-120596 A remotely exploitable denial-of-service vulnerability exists in the TCP options parser… CWE-835
• CVE-2026-120458 Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in… CWE-835
• CVE-2026-120251 imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in… CWE-835
• CVE-2026-120194 A flaw was found in json-glib. CWE-835
• CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-835