PT-2026-136161
CVE-2026-121404
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
Found an issue in the description? Have something to add? Feel free to write us 👾