CVE-2026-110830: FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
FreeRDP clients running a version before 3.32.0 are exposed when they connect to a malicious RDP server that can issue serial IRP_MJ_CREATE requests.
What does an attacker need to exploit this issue?
An attacker needs to operate or control an RDP server that the vulnerable FreeRDP client connects to. No client-side privileges or user interaction beyond establishing that RDP connection are specified.
What is the effect of successful exploitation?
Repeated serial IRP_MJ_CREATE requests can accumulate unclosed file descriptors until the client terminates at the CommReadFile FD_SETSIZE assertion. The reported impact is denial of service; no confidentiality or integrity impact is indicated.
How can the issue be remediated?
Upgrade FreeRDP to version 3.32.0 or later. The affected versions are those before 3.32.0.