CVE-2026-109947: FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRPMJREAD with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients from version 3.20.1 up to, but not including, 3.32.0 are exposed when interacting with a malicious RDP server that can issue drive-redirection read requests.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that a vulnerable FreeRDP client connects to. The server can send an IRP_MJ_READ request with a Length value of 0xffffffff.
What is the likely effect on affected clients?
On 64-bit builds, the crafted request can trigger an approximately 4 GiB zeroed memory allocation and exhaust client memory. On 32-bit builds, it can result in an under-reserved buffer.
How can I determine whether an installation is affected?
Check the installed FreeRDP version. Versions starting at 3.20.1 and earlier than 3.32.0 are in the affected range.