FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap…
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- FreeRDP
- Product
- FreeRDP
- CVSS v3.1
- 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness
- CWE-770
- NVD status
- Analyzed
Why it ranks 18 (Routine)
- CVSS v3.1 6.5 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- Vendor advisory (github.com)
- CVE-2026-121412 on this site · NVD · CVE.org · Vulnpedia