FreeRDP CVE-2026-67296

Exploitation requires that FreeRDP is deployed in server mode (acting as an RDP server endpoint with the RDPEI virtual channel enabled), which is less common than its typical use as an RDP client library. The CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L/AT:N) confirms that once a server-mode target is reachable, no authentication, no user interaction, and no special configuration toggle beyond RDPEI being active are required - a malicious client can trigger the allocation immediately upon connection at the protocol handshake phase before any credential exchange. Exploitation is bounded by: (1) FreeRDP must be the server, not the client; (2) the RDPEI channel must be enabled server-side; (3) the attacker must have TCP connectivity to the RDP listener port. No special client capabilities or elevated privileges are needed.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects that exploitation requires no authentication, no user interaction, and no special attack conditions beyond network reachability to the RDP service. Impact is confined entirely to availability (VA:H), with no confidentiality or integrity impact - consistent with a memory exhaustion DoS rather than code execution. No EPSS score was provided in the available intelligence. KEV status is unconfirmed - CISA has not listed this CVE, and no public exploit code has been identified at time of analysis, reducing immediate urgency. The real-world risk is meaningfully bounded by deployment mode: FreeRDP is far more commonly deployed as an RDP client library than as a server endpoint; organizations not exposing a FreeRDP-based server to untrusted clients are not exposed to this attack path. For those operating FreeRDP in server mode with RDPEI enabled on an Internet- or tenant-reachable network, the unauthenticated pre-auth vector makes this a genuine priority patch.

An attacker with network access to a FreeRDP-based RDP server connects without credentials and sends a single crafted RDPEI message containing only a valid protocol header with a declared body length set to the maximum 32-bit unsigned integer value but an empty body. The server's channel handler allocates a buffer of that declared size immediately, consuming gigabytes of virtual memory. Repeating this connection loop across multiple TCP sessions - requiring no authentication at any step - can sustain memory pressure sufficient to crash the server process or starve co-located services of memory, denying service to all legitimate RDP sessions.