Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121388— FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST

Quick assessment

Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeRDP 3.0.0 至 3.32.2（不含 3.32.2）版本中存在一个不受控的资源分配漏洞。恶意 RDP 服务器可利用该漏洞，通过 DRDYNVC DATA_FIRST 长度字段强制客户端进行大规模内存分配。攻击者可在运行的动态通道上声明高达 4,294,967,295 字节的长度，导致 StreamPool_Take 在验证数据体之前预先预留内存，从而耗尽客户端内存资源。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1499.001 · OS Exhaustion Flood
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121388

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FreeRDP FreeRDP 3.0.0 ~ 3.32.2 -

II. Public POCs for CVE-2026-121388

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121388

请登录查看更多情报信息。

Other References for CVE-2026-121388 (2)

Same Patch Batch · FreeRDP · 2026-11-03 · 27 CVEs total

CVE-2026-121386 7.5 HIGH FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers
CVE-2026-121392 7.4 HIGH FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
CVE-2026-121395 6.5 MEDIUM FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder
CVE-2026-121400 6.5 MEDIUM FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
CVE-2026-121404 6.5 MEDIUM FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
CVE-2026-121412 6.5 MEDIUM FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
CVE-2026-121407 6.5 MEDIUM FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
CVE-2026-121393 6.5 MEDIUM FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion
CVE-2026-121402 6.5 MEDIUM FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
CVE-2026-121394 6.5 MEDIUM FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder
CVE-2026-121409 5.9 MEDIUM FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
CVE-2026-121398 5.9 MEDIUM FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module
CVE-2026-121408 5.3 MEDIUM FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
CVE-2026-121401 4.3 MEDIUM FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet
CVE-2026-121405 4.3 MEDIUM FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control
CVE-2026-121403 4.3 MEDIUM FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
CVE-2026-121387 4.3 MEDIUM FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder
CVE-2026-121406 4.3 MEDIUM FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload
CVE-2026-121390 4.3 MEDIUM FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response
CVE-2026-121397 4.3 MEDIUM FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()

Showing top 20 of 27 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: FreeRDP
Same vendor: FreeRDP
Same weakness: CWE-770