CVE-2026-121404

A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service (DoS) by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol (RDP) session. Because the server fails to properly consume these empty messages, receiving server threads enter an infinite loop. This behavior exhausts system CPU resources and degrades performance until the client disconnects.

A flaw was found in FreeRDP. An attacker controlling an RDP server can cause a connected FreeRDP client to spin indefinitely by sending zero-length dynamic virtual channel messages, resulting in a denial of service. An authenticated RDP session is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.