CVE-2026-121391: FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE

Q: Which users are exposed to this issue?

FreeRDP clients in versions 3.0.0 through versions before 3.32.2 are exposed when parallel-device redirection is enabled and they connect to a hostile RDP server.

Q: What must an attacker do to trigger the issue?

The attacker needs to operate or control an RDP server that the client connects to. The server can repeatedly send IRP_MJ_CREATE requests through parallel-device redirection to consume the client's file descriptors.

Q: What is the practical impact?

Repeated requests can exhaust the FreeRDP client's descriptor table and crash the client process. The provided information identifies availability impact only, with no confidentiality or integrity impact.

Q: What can be done before updating?

If updating to 3.32.2 or later is not immediately possible, avoid connecting to untrusted RDP servers and disable parallel-device redirection where feasible.

Q: How can I determine whether a client is affected?

Check the FreeRDP version and whether parallel-device redirection is enabled. Versions before 3.0.0 are not identified as affected by the provided information, while versions from 3.0.0 before 3.32.2 are affected under the required configuration.

Published Nov 3, 2026

Updated

FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallelprocessirpcreate that fails to close previous descriptors on repeated IRPMJCREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp>=3.0.0<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

Affected Software

Frequently Asked Questions

Which users are exposed to this issue?

FreeRDP clients in versions 3.0.0 through versions before 3.32.2 are exposed when parallel-device redirection is enabled and they connect to a hostile RDP server.

What must an attacker do to trigger the issue?

The attacker needs to operate or control an RDP server that the client connects to. The server can repeatedly send IRP_MJ_CREATE requests through parallel-device redirection to consume the client's file descriptors.

What is the practical impact?

Repeated requests can exhaust the FreeRDP client's descriptor table and crash the client process. The provided information identifies availability impact only, with no confidentiality or integrity impact.

What can be done before updating?

If updating to 3.32.2 or later is not immediately possible, avoid connecting to untrusted RDP servers and disable parallel-device redirection where feasible.

How can I determine whether a client is affected?

Check the FreeRDP version and whether parallel-device redirection is enabled. Versions before 3.0.0 are not identified as affected by the provided information, while versions from 3.0.0 before 3.32.2 are affected under the required configuration.

CVE-2026-121391: FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users are exposed to this issue?

What must an attacker do to trigger the issue?

What is the practical impact?

What can be done before updating?

How can I determine whether a client is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users are exposed to this issue?

What must an attacker do to trigger the issue?

What is the practical impact?

What can be done before updating?

How can I determine whether a client is affected?