FreeRDP CVE-2026-121388

Exploitation requires the victim to connect their FreeRDP client to a malicious or compromised RDP server, that DRDYNVC be negotiated, and that at least one dynamic virtual channel has been created and is in DVC_CHANNEL_RUNNING state (the relevant build/plugin must accept the channel creation). The server then sends a DRDYNVC DATA_FIRST PDU whose 32-bit Length field declares up to 4,294,967,295 bytes, which FreeRDP passes to StreamPool_Take before validating or receiving the body. Limiting factors: this is a server-to-client attack gated by user-initiated connection (UI:P), impact is confined to client availability (memory exhaustion) with no code execution or data disclosure, and it affects only client builds running at least one dynamic channel. Multiple accepted channels can each retain independent reservations, amplifying the exhaustion.

This is a client-side denial-of-service (memory exhaustion) issue, not a code-execution or data-exposure flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 7.1 and isolates impact to availability (VA:H) with no confidentiality or integrity effect, consistent with the CWE-770/CWE-789 uncontrolled/uncapped allocation. The directionality matters: the attacker is a malicious or compromised RDP *server* and the victim is the FreeRDP *client*, so UI:P reflects that a user must initiate a connection to the hostile server - exploitation is not spontaneously remote against an exposed service. No CISA KEV listing is present and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; the only exploitation signal is a PoC. The PoC is a bounded production-source verifier that compiles the real drdynvc_main.c parser and confirms StreamPool_Take reserves the full declared length before body validation at a 16-MiB bound - it proves the parser-to-pool ordering and the absence of a cap, but it is not a working network exploit and does not demonstrate end-to-end remote client crashes. The vuln.today Decision label is this_week, so this warrants prompt patching but the signals do not indicate an emergency: the real-world risk is a moderate, interaction-gated client DoS rather than a high-CVSS flaw with imminent mass exploitation.

A user is lured or redirected to connect their FreeRDP client to an attacker-controlled or compromised RDP server. Once DRDYNVC is negotiated and a dynamic channel reaches the running state, the server sends a DATA_FIRST PDU declaring a Length of up to 4,294,967,295 bytes with little or no body, causing the client to reserve that memory immediately and exhaust address space/commit. A bounded production-source PoC exists confirming the pre-validation reservation at 16 MiB, though it is not a working network exploit.