CVE-2026-121403: FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP

Q: Who can exploit this issue?

A malicious RDP server can exploit it against a vulnerable FreeRDP client session. Exploitation requires the user to connect to that server and for drive-related requests to be processed.

Q: What is the impact of a successful exploit?

The malformed request silently terminates the drive worker. Subsequent requests can accumulate without bound in the IRP queue, exhausting memory and causing loss of session availability.

Q: Which versions are affected?

FreeRDP versions before 3.32.2 are affected. Updating to 3.32.2 or later addresses the affected version range described.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

A malicious RDP server can exploit it against a vulnerable FreeRDP client session. Exploitation requires the user to connect to that server and for drive-related requests to be processed.

What is the impact of a successful exploit?

The malformed request silently terminates the drive worker. Subsequent requests can accumulate without bound in the IRP queue, exhausting memory and causing loss of session availability.

Which versions are affected?

FreeRDP versions before 3.32.2 are affected. Updating to 3.32.2 or later addresses the affected version range described.

CVE-2026-121403: FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Which versions are affected?