FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

Summary

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.

Remediation

1. Inventory every FreeRDP FreeRDP deployment, including staging.
2. Upgrade FreeRDP FreeRDP to 3.32.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498
• Advisoryhttps://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data