CVE-2026-121412
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Nov 3, 2026
CISA due date
—
The record
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
- CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
- CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770
- CVE-2026-115716 Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to… CWE-770
- CVE-2026-118487 In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in… CWE-770
- CVE-2026-108147 An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13… CWE-770
- CVE-2026-121405 FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP… CWE-770