Is CVE-2026-121399 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121399?

CVE-2026-121399 has a CVSS v3 severity of MEDIUM (4.3).

What does CVE-2026-121399 affect?

CVE-2026-121399 affects freerdp.

Back

CVE-2026-121399

Monitor on ThreatCluster

Description

FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.