CVE-2026-121388

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message data, an attacker can exhaust client system memory, resulting in an application crash and a Denial of Service (DoS).

A flaw was found in FreeRDP. A remote attacker controlling an RDP server can exhaust client memory by sending DRDYNVC DATA_FIRST messages with an oversized length field, resulting in a denial of service. The user must connect to an attacker-controlled server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.