FreeRDP Proxy CVE-2026-121412

The attacker must be able to establish an RDP session through the FreeRDP proxy (hence authenticated, PR:L), and the deployment must have the proxy configured - via its configuration or a loaded module - to intercept a DVC that the attacker can reach. The tested path used a target-created AUDIO_INPUT channel together with FreeRDP's shipped dyn-channel-dump module. Exploitation is therefore limited to proxy deployments that actually enable DVC interception; plain client/server FreeRDP use without the interception proxy is not in scope. The impact is availability degradation only (traffic-proportional heap retention, approximately 6.55 MiB per incomplete message in the cited test, with ASan amplifying reported RSS).

This is a genuine but bounded denial-of-service issue, not a high-CVSS-but-low-real-risk artifact, though its priority is moderate rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the VA:H/VC:N/VI:N profile correctly frame it as a network-reachable, low-complexity, authenticated availability-only flaw with no confidentiality or integrity impact - consistent with CWE-770/CWE-400 uncontrolled resource consumption. PR:L is well supported by the advisory prerequisite that the attacker must first establish an RDP session through the proxy, so this is not unauthenticated. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a degrade-service-only impact rather than code execution. No CISA KEV listing and no EPSS score are present in the input, so widespread or active exploitation cannot be asserted; the GHSA documents a controlled lab reproduction (a 6,553,600-byte incomplete message), not in-the-wild use. Two signals should be flagged as conflicting: the CVE/package metadata states 'fixed in 3.32.2', yet the GHSA remediation text says 'No upstream fix was found in current master' - verify the actual fixed build with the vendor before relying on 3.32.2. Overall, prioritize patching of proxy deployments within the normal cycle, but treat it below RCE-class work.

An attacker who can authenticate and establish an RDP session through a FreeRDP proxy configured to intercept a dynamic virtual channel declares a very large DATA_FIRST length and then streams fragments indefinitely without ever completing the message. The proxy appends every fragment to a reassembly buffer with no cumulative ceiling, so heap usage grows in proportion to the traffic sent, degrading or exhausting the shared proxy. No public working exploit code is identified in the input; the advisory describes only a lab reproduction.