CVE-2026-121412

A flaw was found in FreeRDP. This vulnerability allows an authenticated remote client to cause a Denial of Service (DoS) by exhausting system memory on the proxy server. When intercepting Dynamic Virtual Channel (DVC) communications, the proxy does not enforce cumulative limits on reassembling fragmented messages. An attacker can exploit this by transmitting incomplete fragments with large declared message sizes, continuously consuming proxy heap memory and degrading service availability.

This vulnerability is rated as having Moderate impact because it results solely in a denial of service condition without affecting the confidentiality or integrity of the host system. In typical Red Hat Enterprise Linux environments, FreeRDP is predominantly utilized as an RDP client rather than an intermediary proxy service, which significantly limits widespread exposure. Furthermore, exploitation requires an attacker to establish a valid client session through the proxy to drive memory exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the FreeRDP proxy service to trusted IP addresses or subnets using firewalld, preventing arbitrary clients from establishing sessions and consuming proxy heap memory:

1. Allow access only from trusted source networks to the proxy port (commonly TCP port 3389):

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3389" protocol="tcp" accept'

firewall-cmd --reload

Warning: Reloading firewall rules may temporarily interrupt existing network sessions.

2. Operational Caveat: Limiting access strictly to authorized management subnets prevents untrusted clients from initiating RDP proxy connections, but it will block any legitimate clients connecting from outside the specified network ranges. If the proxy service is not required, terminate any standalone proxy instances.