CVE-2026-121412: freerdp DVC reassembly memory

CISO Take

FreeRDP 3.0.0 through 3.32.1 has a flaw in its proxy component. An authenticated client can declare a large DATA_FIRST length for a dynamic virtual channel message and keep sending fragments without finishing it. The proxy keeps buffering them and its heap grows until the service degrades or crashes. The impact is availability only, with no confidentiality or integrity loss (CVSS 6.5, medium). It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS score is available, so near-term exploitation risk looks low. FreeRDP is a generic remote desktop library and is not a core AI/ML component. It matters only if the FreeRDP proxy fronts remote desktops used for GPU workstations, notebooks or MLOps administration. Upgrade to FreeRDP 3.32.2 or later, and until then limit proxy access to trusted users and cap per-process memory.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium. The attack is network-reachable with low complexity and needs only low privileges (a connected, authenticated client) and no user interaction. The impact is limited to availability: memory use grows with attacker traffic until the proxy degrades or is killed. There is no known exploitation, no KEV listing, no public exploit and no scanner template. The AI/ML relevance is indirect, since FreeRDP is a general-purpose remote desktop stack. Exposure depends on whether the FreeRDP proxy is deployed in front of AI infrastructure. The advisory does not state how many dependents or deployments are affected.

How does the attack unfold?

Initial Access

The attacker authenticates to the FreeRDP proxy with low-privilege credentials over the network.

AML.T0012

Exploitation

The attacker declares a large DATA_FIRST length on a dynamic virtual channel and keeps sending fragments without completing the message.

Impact

The proxy's heap grows with the traffic until the service degrades or crashes, cutting remote access to the AI/ML hosts behind it.

AML.T0029

Initial Access

The attacker authenticates to the FreeRDP proxy with low-privilege credentials over the network.

AML.T0012

Exploitation

The attacker declares a large DATA_FIRST length on a dynamic virtual channel and keeps sending fragments without completing the message.

Impact

The proxy's heap grows with the traffic until the service degrades or crashes, cutting remote access to the AI/ML hosts behind it.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
freerdp	—	—	No patch

Do you use freerdp? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade FreeRDP to 3.32.2 or later (the fix is in the vendor advisory GHSA-m7xq-5f7v-hjvw). 2) Until patched, restrict proxy access to trusted networks and authenticated users, for example through VPN or network ACLs. 3) Set memory limits (cgroups, container limits or systemd MemoryMax) and an automatic restart for the proxy process. 4) Monitor proxy resident memory and alert on steady growth tied to a single client session. 5) Cap per-client session duration and the number of concurrent connections. 6) Inventory where the FreeRDP proxy is deployed, including in front of AI/ML workstations and jump hosts, using SBOM or package scans.

How is it classified?

DoSFrameworkAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

Frequently Asked Questions

What is CVE-2026-121412?

FreeRDP 3.0.0 through 3.32.1 has a flaw in its proxy component. An authenticated client can declare a large DATA_FIRST length for a dynamic virtual channel message and keep sending fragments without finishing it. The proxy keeps buffering them and its heap grows until the service degrades or crashes. The impact is availability only, with no confidentiality or integrity loss (CVSS 6.5, medium). It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS score is available, so near-term exploitation risk looks low. FreeRDP is a generic remote desktop library and is not a core AI/ML component. It matters only if the FreeRDP proxy fronts remote desktops used for GPU workstations, notebooks or MLOps administration. Upgrade to FreeRDP 3.32.2 or later, and until then limit proxy access to trusted users and cap per-process memory.

Is CVE-2026-121412 actively exploited?

No confirmed active exploitation of CVE-2026-121412 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-121412?

1) Upgrade FreeRDP to 3.32.2 or later (the fix is in the vendor advisory GHSA-m7xq-5f7v-hjvw). 2) Until patched, restrict proxy access to trusted networks and authenticated users, for example through VPN or network ACLs. 3) Set memory limits (cgroups, container limits or systemd MemoryMax) and an automatic restart for the proxy process. 4) Monitor proxy resident memory and alert on steady growth tied to a single client session. 5) Cap per-client session duration and the number of concurrent connections. 6) Inventory where the FreeRDP proxy is deployed, including in front of AI/ML workstations and jump hosts, using SBOM or package scans.

What systems are affected by CVE-2026-121412?

This vulnerability affects the following AI/ML architecture patterns: Remote administration gateways for ML workstations, Jump hosts and bastions for GPU/training clusters, Remote desktop access to MLOps environments.

What is the CVSS score for CVE-2026-121412?

CVE-2026-121412 has a CVSS v3.1 base score of 6.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Remote administration gateways for ML workstationsJump hosts and bastions for GPU/training clustersRemote desktop access to MLOps environments

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

Exploitation Scenario

An attacker with valid low-privilege credentials, such as a compromised contractor account, connects through a FreeRDP proxy that gives access to a GPU training workstation. They open a dynamic virtual channel and send a DATA_FIRST header declaring a very large message length. They then keep sending fragments without ever completing the message, so the proxy retains heap memory in proportion to the traffic. Repeating this across several sessions drives the proxy to memory exhaustion. Remote access for the ML team drops until the proxy is restarted, and the attacker can repeat the attack to keep it down.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.