CVE-2026-121404: 
NixOS Schwachstellenanalyse und -minderung

CVE-2026-121404 is a denial-of-service vulnerability in the FreeRDP shadow server that allows authenticated RDP clients to exhaust CPU resources by sending zero-length drdynvc DATA PDUs. All FreeRDP versions before 3.32.2 are affected. The vulnerability was published on November 3, 2026, with a patch available in version 3.32.2. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (FreeRDP Advisory, GitHub Advisory).

The root cause is uncontrolled resource consumption (CWE-400) combined with a loop with an unreachable exit condition (CWE-835) in wts_read_drdynvc_data within libfreerdp/core/server.c. The function queues DATA payloads even when Stream_GetRemainingLength(s) == 0, and FreeRDP_WTSVirtualChannelRead peeks with removal disabled, returning before consuming an empty head when called with a null buffer. As a result, the queue event remains perpetually signaled: the audin reader loops continuously, and if rdpgfx receives an empty message, the shadow client thread also spins. Exploitation requires the attacker to first authenticate and complete DVC channel creation for audin or rdpgfx; unknown or unopened channels do not reach the vulnerable queue path. The same vulnerable reader pattern exists in ainput, disp, location, echo, telemetry, rdpemsc, rdpecam, and the unused drdynvc server plugin, though stock shadow does not start those readers (FreeRDP Advisory).

Successful exploitation causes full CPU core consumption on the FreeRDP shadow server for the duration of the attacker's connection, degrading or denying service to legitimate users. Testing demonstrated approximately one CPU core consumed per affected channel (507 ticks/5s for audin alone; ~1011 ticks/5s for audin plus rdpgfx), with CPU returning to near-idle after disconnect. There is no confidentiality or integrity impact — no crash, memory corruption, or data disclosure was demonstrated (FreeRDP Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low-privilege authenticated access to the RDP shadow server, and the standard FreeRDP client API refuses zero-length DVC writes, meaning a custom or modified client (e.g., using an LD_PRELOAD shim to mutate outgoing PDUs post-serialization) is needed to trigger the condition (FreeRDP Advisory, GitHub Advisory).

1. Authenticate to the target: Obtain valid credentials for the FreeRDP shadow server and establish an authenticated RDP session using any compliant RDP client.
2. Negotiate DVC channels: Allow the RDP session to complete channel negotiation so that audin (audio input) and/or rdpgfx (graphics pipeline) dynamic virtual channels are opened between client and server.
3. Prepare a PDU-shaping tool: Since the standard xfreerdp client refuses zero-length DVC writes, compile and load the zero_len_dvc_preload.so LD_PRELOAD shim (as documented in the advisory) that intercepts MessageQueue_Dispatch and truncates outgoing drdynvc DATA PDUs to zero application payload (command byte + channel ID only).
4. Send zero-length DATA PDU: With the shim active, trigger transmission of a drdynvc DATA PDU on the target channel (e.g., audin channel ID 1). The shim reduces DataLength to 1 + idbytes, emitting a valid DATA_PDU with zero payload to the server.
5. Trigger CPU spin: The server's wts_read_drdynvc_data queues the zero-byte message; FreeRDP_WTSVirtualChannelRead never consumes it, leaving the queue event signaled. The audin_server_thread_func (and optionally shadow_client_thread for rdpgfx) enters a busy loop consuming one full CPU core per affected channel.
6. Sustain the attack: Maintain the RDP connection to keep the CPU spin active. Repeat for additional channels (e.g., rdpgfx) to consume additional cores. CPU exhaustion persists until the attacker disconnects (FreeRDP Advisory).

• Process: Sustained near-100% CPU utilization on one or more threads of the freerdp-shadow-cli process (specifically audin_server_thread_func and/or shadow_client_thread) while an RDP client session is active; CPU returns to idle immediately after client disconnect.
• Logs: FreeRDP shadow server logs showing audin or Gfx Pipeline channel activity from a connected client with no corresponding data processing; repeated zero-byte channel read events in verbose debug logs.
• Network: Authenticated RDP sessions to the shadow server (default port 3389 or custom) where the client sends drdynvc DATA PDUs with payload length of zero (PDU body is only command byte plus channel ID bytes, typically 2 bytes total for a 1-byte channel ID).
• System: /proc/<shadow_pid>/task/<tid>/stat showing abnormally high utime+stime values for specific shadow server threads during an active client session (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which drops or properly consumes zero-length DVC DATA messages before they enter the channel queue and ensures FreeRDP_WTSVirtualChannelRead removes or rejects zero-length queue heads. As a network-level workaround, restrict RDP access to the shadow server to trusted, known-good clients using firewall rules or VPN, reducing the attack surface to authenticated users who cannot be easily controlled. Monitor CPU utilization on FreeRDP shadow servers for anomalous thread spinning patterns as an interim detection measure (FreeRDP Advisory, GitHub Advisory).