CVE-2026-110831: FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in driveprocessirpcreate, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRPMJCREATE with AllocationSize set to UINT64MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running versions 3.13.0 before 3.32.0 are exposed when drive redirection is enabled and they connect to a malicious RDP server.
What must an attacker do to trigger the leak?
An attacker needs to operate or control the RDP server the client connects to. The server sends an IRP_MJ_CREATE request with AllocationSize set to UINT64_MAX, causing the allocation-size seek to fail after the local file has been registered.
What is the impact of successful exploitation?
The failed request leaves the local file object and its operating-system handle retained until drive teardown. Repeated triggering can consume resources and cause a denial-of-service condition.
What can be done if upgrading is not immediately possible?
Disable drive redirection when connecting to untrusted or potentially malicious RDP servers. This prevents the affected drive redirection request path from being used.