Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121403FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
Medium 4.3
In plain English
A medium-severity resource allocation without limits in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-121403 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-121403 |
| Debian:14 | freerdp3 | 3.32.2+dfsg-1 | DEBIAN-CVE-2026-121403 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-121403 |
| Ubuntu:24.04:LTS | freerdp3 | no fix listed | UBUNTU-CVE-2026-121403 |
| Ubuntu:26.04:LTS | freerdp3 | no fix listed | UBUNTU-CVE-2026-121403 |
| Ubuntu:26.10 | freerdp3 | no fix listed | UBUNTU-CVE-2026-121403 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-5qqp-5ffm-m3p9) vendor-advisory
- VulnCheck Advisory: FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP third-party-advisory