7 matches found
CVE-2026-121400
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLengt...
CVE-2026-121400 FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLengt...
EUVD-2026-115932
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLengt...
CVE-2026-121400
FreeRDP versions before 3.32.2 are vulnerable to a denial-of-service flaw within the rdg_process_control_packet function. A malicious RD Gateway can trigger CPU exhaustion by sending an incomplete keepalive control packet. Specifically, after completing the RDG tunnel-open exchange, the attacker ...
CVE-2026-121400: FreeRDP: FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious…
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLengt...
CVE-2026-109942
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...
CVE-2026-109942
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...