FreeRDP CVE-2026-121398

Requires a freerdp-proxy deployment whose client thread uses the dyn-channel-dump module, and an attacker who controls the backend RDP target the proxy connects to (a malicious or compromised RDP server, not an arbitrary internet client). The attacker must send dynamic channel data in the narrow window while the front client is disconnecting (session teardown), winning a cross-thread race - this timing dependence is reflected in AC:H and AT:P and makes the bug non-deterministic to trigger. Limiting factors: impact is confined to crashing the proxy (availability only; no confidentiality or integrity impact, no indication of code execution), and exploitation presupposes the proxy is actually configured to route through a target the attacker can influence.

This is a denial-of-service issue, not a code-execution or data-exposure one: both the input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/...) and the description agree the only impact is a crash of the freerdp-proxy process (VA:H with VC:N/VI:N). The 8.2 'high' score is driven by availability impact plus network reach, but it is tempered by AC:H and AT:P, reflecting the described cross-thread race that must be won during session teardown - exploitation is timing-dependent and not reliably repeatable. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but non-critical DoS. No EPSS score is provided, the CVE is not in CISA KEV, and the two references are vendor/analyst advisories (FreeRDP GHSA and VulnCheck) rather than exploit code, so there is no public exploit identified at time of analysis. Net: a legitimate prioritization item for anyone running freerdp-proxy, but it is a crash/availability bug rather than a memory-corruption-to-RCE emergency, and the race-condition trigger further lowers real-world exploitability versus the raw score. Missing signals (no EPSS, no KEV, no confirmed PoC) mean exploitation likelihood is inferred, not measured.

An attacker who controls (or has compromised) the backend RDP server that a freerdp-proxy deployment connects to sends dynamic channel data at the moment a front-end client disconnects, so the proxy's client thread reads ChannelData that the teardown path has already freed. Winning this race crashes the proxy process, dropping sessions for all users behind that proxy instance. No public exploit code is identified at time of analysis; the race (AC:H/AT:P) makes reliable triggering difficult.