CVE-2026-109947

6.5Medium

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-770

Impact

A malicious RDP server can crash the FreeRDP client by exhausting system memory. The attacker needs a user to connect to their rogue server with drive redirection enabled.

Root cause

FreeRDP does not validate the length parameter in incoming IRP_MJ_READ drive redirection requests, allocating up to 4 GiB of memory when receiving 0xffffffff.

Affected systems

FreeRDP from 3.20.1 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. If upgrading must wait, disable drive redirection in your RDP client configurations or avoid connecting to untrusted hosts.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp2-x11 || sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109947