CVE-2026-121405: FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

Q: Which clients are exposed to this issue?

FreeRDP clients before 3.32.2 are exposed when they connect to a malicious server that can use serial redirection and send the crafted device-control request.

Q: What does an attacker need to do to exploit it?

The attacker needs to operate or control an RDP server that the victim connects to. The server sends an IRP_MJ_DEVICE_CONTROL request using IOCTL_USBPRINT_GET_1284_ID with a near-maximum OutputBufferLength.

Q: What is the expected impact?

The crafted request can cause excessive memory allocation on the FreeRDP client, potentially exhausting available memory and causing a denial of service.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a near-maximum length to exhaust client memory.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which clients are exposed to this issue?

FreeRDP clients before 3.32.2 are exposed when they connect to a malicious server that can use serial redirection and send the crafted device-control request.

What does an attacker need to do to exploit it?

The attacker needs to operate or control an RDP server that the victim connects to. The server sends an IRP_MJ_DEVICE_CONTROL request using IOCTL_USBPRINT_GET_1284_ID with a near-maximum OutputBufferLength.

What is the expected impact?

The crafted request can cause excessive memory allocation on the FreeRDP client, potentially exhausting available memory and causing a denial of service.

CVE-2026-121405: FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

Affected Software

Remediation

Event History

Frequently Asked Questions

Which clients are exposed to this issue?

What does an attacker need to do to exploit it?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to this issue?

What does an attacker need to do to exploit it?

What is the expected impact?