CVE-2026-121404
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Nov 3, 2026
CISA due date
—
The record
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116668 Tanium addressed an uncontrolled resource consumption vulnerability in Discover. CWE-400
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-400
- CVE-2026-111752 Angular is a development platform for building mobile and desktop web applications using… CWE-400
- CVE-2026-63476 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-400
- CVE-2026-121444 svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of… CWE-400
- CVE-2026-121438 Mistune before 3.3.3 contains a denial of service vulnerability in… CWE-400
- CVE-2026-49924 In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via… CWE-400
- CVE-2026-117531 @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web… CWE-400