Is CVE-2026-121404 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121404?

CVE-2026-121404 has a CVSS v3 severity of MEDIUM (6.5).

What does CVE-2026-121404 affect?

CVE-2026-121404 affects freerdp.

Back

CVE-2026-121404

Monitor on ThreatCluster

Description

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.