CVE-2026-121399
MEDIUM
freerdp
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
freerdp
Description
FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.