CVE-2026-121404

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A denial of service issue exists in the shadow server where authenticated RDP clients can cause server threads to spin by sending zero-length drdynvc DATA PDUs (Protocol Data Units). By sending empty DATA messages on opened audin or rdpgfx channels, the FreeRDP WTSVirtualChannelRead() function fails to consume them, leading to full CPU core consumption until the connection is terminated.

Recommendations Update to version 3.32.2 or later.