CVE-2026-121412FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

Beschreibung

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Ubuntu-Korrekturen

• USN-9007-1 FreeRDP vulnerabilities Ubuntu 26.10, 26.04, 24.04 · 09.11.2026 · freerdp3

Referenzen und Patches

• GitHub Security Advisory (GHSA-m7xq-5f7v-hjvw) vendor-advisoryVendor Advisory
• VulnCheck Advisory: FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly third-party-advisoryThird Party Advisory