CVE-2026-121388: 
NixOS 脆弱性分析と緩和策

CVE-2026-121388 is an uncontrolled resource allocation vulnerability in FreeRDP's DRDYNVC channel handler that allows a malicious RDP server to exhaust client memory. It affects FreeRDP versions 3.0.0 through 3.32.1, and is fixed in version 3.32.2. The vulnerability was published on November 3, 2026, and was reported by researcher iPlayForSG. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (FreeRDP Advisory, Github Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-789 (Memory Allocation with Excessive Size Value). When a DRDYNVC DATA_FIRST PDU is received, the function drdynvc_process_data_first reads a 32-bit Length field from the packet and passes it directly to StreamPool_Take before validating or receiving the corresponding body data. StreamPool_Take calls Stream_New(nullptr, size) which invokes calloc with the full declared size — up to 4,294,967,295 bytes (UINT32_MAX) — with no per-message, per-channel, or session-level reservation limit. The only gate is that the channel exists and is in DVC_CHANNEL_RUNNING state; multiple open dynamic virtual channels (DVCs) can each hold independent reservations simultaneously (FreeRDP Advisory).

Successful exploitation results in a denial-of-service condition on the FreeRDP client: the client application crashes or becomes unresponsive due to memory exhaustion. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. An attacker operating a malicious or compromised RDP server can trigger this condition against any user who connects to it, without requiring any privileges on the client system (FreeRDP Advisory, Github Advisory).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction — specifically, a user must connect to a malicious RDP server — and DRDYNVC must be negotiated with at least one dynamic channel in DVC_CHANNEL_RUNNING state. A bounded PoC harness was included in the security advisory to demonstrate the parser behavior, but it does not open a network socket or attempt the maximum UINT32 value (FreeRDP Advisory, Github Advisory).

1. Set up a malicious RDP server: The attacker configures a server that speaks the RDP protocol and can send crafted DRDYNVC PDUs to connecting clients.
2. Lure the victim to connect: The attacker tricks a user running a vulnerable FreeRDP client (versions 3.0.0–3.32.1) into connecting to the malicious server, e.g., via a phishing link or social engineering.
3. Negotiate DRDYNVC: During the RDP session setup, the attacker's server negotiates the Dynamic Virtual Channel (DRDYNVC) extension and creates at least one dynamic channel, bringing it to DVC_CHANNEL_RUNNING state.
4. Send crafted DATA_FIRST PDU: The attacker sends a DRDYNVC DATA_FIRST PDU with the 32-bit Length field set to a large value (up to 4,294,967,295 bytes) and a minimal or empty body.
5. Trigger memory exhaustion: The client's drdynvc_process_data_first function passes the declared length to StreamPool_Take, which calls calloc to reserve the full amount before any body validation. Repeating this across multiple DVCs amplifies the effect, exhausting client memory and causing a crash or hang (FreeRDP Advisory).

• Process: FreeRDP client process (xfreerdp, wlfreerdp, or similar) consuming abnormally large amounts of RAM during an RDP session, followed by an out-of-memory crash or unresponsive state.
• Logs: System OOM (out-of-memory) killer logs referencing the FreeRDP process (e.g., /var/log/syslog or dmesg entries with oom-kill for the FreeRDP PID).
• Network: RDP sessions to unfamiliar or external server IP addresses, particularly those that terminate abruptly after the DRDYNVC channel negotiation phase.
• File System: Core dump files generated by the FreeRDP process following a crash during an RDP session.

Upgrade FreeRDP to version 3.32.2 or later, which contains the fix for this vulnerability. As a configuration-based workaround, restrict FreeRDP clients to connect only to trusted, known-good RDP servers, and consider disabling DRDYNVC channel support if dynamic virtual channels are not required. Monitor client systems for unusual memory consumption during RDP sessions as an additional detection measure (FreeRDP Advisory, Github Advisory).