FreeRDP CVE-2026-121400

Exploitation requires a deployment that uses an RD Gateway (the FreeRDP /gateway option with HTTP/WebSocket transport, e.g. type:http) AND an attacker who controls, has compromised, or can machine-in-the-middle that gateway. The attacker must first complete the RDG tunnel-open exchange (HANDSHAKE_RESPONSE, TUNNEL_RESPONSE, TUNNEL_AUTH_RESPONSE, CHANNEL_RESPONSE success replies) so the tunnel reaches RDG_CLIENT_STATE_OPENED, then send a non-data control packet - an eight-byte header with packetLength=0xFFFF - and withhold the body. Limiting factors that reduce realistic risk: the victim client must itself initiate the connection through the malicious gateway (UI:P/UI:R), direct RDP connections without a gateway are not affected, and impact is confined to CPU exhaustion of one client thread (a user-requested abort is still polled; no process crash). The non-WebSocket transport also reproduces the spin, so the condition is not limited to the WebSocket transport.

This is a client-side denial-of-service with availability-only impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) yields 7.1, but that score is driven almost entirely by VA:H - there is no confidentiality or integrity impact and no demonstrated crash, data access, or code execution (confirmed by the advisory). The real-world precondition materially tempers the raw score: exploitation requires the victim FreeRDP client to connect through an RD Gateway that the attacker controls, has compromised, or can machine-in-the-middle (reflected in UI:P / UI:R - the connection must be operator-initiated). No CISA KEV listing and no EPSS score were provided, so there is no confirmed active-exploitation or exploitation-probability signal; exploitation status is therefore 'no public exploit identified at time of analysis' except that the GHSA advisory itself publishes a full fake-gateway reproduction harness (a public PoC reference exists; it is not verified as a weaponized working exploit). The vuln.today decision label is 'this_week', indicating prioritized but non-emergency remediation. Net assessment: a genuine but bounded issue - the high-ish CVSS reflects reliable CPU exhaustion, but impact is limited to spinning one client thread at ~100% CPU, and the attacker must already occupy or impersonate the gateway. With EPSS missing and KEV absent, no signal supports widespread opportunistic exploitation; treat as positional/targeted rather than mass-exploitable.

An attacker who controls, has compromised, or can machine-in-the-middle an RD Gateway waits for a FreeRDP client (<= 3.32.1) to connect; after completing the RDG tunnel-open exchange and reaching RDG_CLIENT_STATE_OPENED, the gateway sends an eight-byte keepalive control header with packetLength=0xFFFF and withholds the declared body. rdg_process_control_packet then retries a no-progress rdg_socket_read whenever BIO_should_retry is true with no wait, backoff, or limit, pinning one client thread at full CPU (measured at 99.8% of one core with 65,527 bytes remaining). The GHSA advisory publishes full C reproduction source (a disposable TLS fake-gateway in 'ctlspin' mode); it is a reproduction harness and not labeled a confirmed weaponized exploit.