CVE-2026-121400

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Gateway (RD Gateway) server can cause a Denial of Service (DoS) by sending an incomplete control packet during an active connection. This causes the client to enter an unbounded read loop, consuming excessive central processing unit (CPU) resources and causing the application to become unresponsive.

This vulnerability is evaluated as Moderate impact because successful exploitation requires connecting to an untrusted or adversarial Remote Desktop Gateway, and the resulting impact is confined to a client-side denial of service rather than code execution or privilege escalation. In typical Red Hat Enterprise Linux environments, FreeRDP is utilized on demand as an interactive remote desktop client and is not exposed as an unauthenticated listening daemon. Because triggering the condition requires initiating an explicit connection through a rogue gateway proxy, standard client operations connecting directly to trusted endpoints remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.