Denial-of-Service in FreeRDP via Malformed RDG Keepalive

Executive Summary

CVE-2026-121400 is a denial-of-service vulnerability in FreeRDP versions up to 3.32.1. A malicious RD Gateway can exploit it by sending an incomplete keepalive control packet after completing the RDG tunnel-open exchange. The packet has a header with packetLength set to 0xFFFF but no payload, causing the client's rdg_process_control_packet function to enter an infinite loop. This loop repeatedly attempts to read from the socket without delay, consuming 100% of a CPU core indefinitely.

Useful 0 Not Useful 0

Detection Guidance

Monitor FreeRDP client processes for sustained high CPU usage on affected systems. Check network traffic for RD Gateway connections sending incomplete keepalive packets with packetLength 0xFFFF and missing payloads. Use tools like Wireshark to inspect RDG control packets for malformed headers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the FreeRDP client to consume 100% of a CPU core on the affected system, leading to degraded performance or unresponsiveness. While it does not allow data access or code execution, it disrupts normal operations by monopolizing system resources until the process is forcibly stopped.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later to address the vulnerability. Implement network-level controls to block or inspect RD Gateway traffic for malformed keepalive packets. Configure timeouts for socket readability and enforce control-packet length limits on affected clients.

Useful 0 Not Useful 0