CVE-2026-121404
MEDIUM
freerdp
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
freerdp
Description
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.