DEBIAN-CVE-2026-121391: Medium severity debian/freerdp2 vulnerability
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallelprocessirpcreate that fails to close previous descriptors on repeated IRPMJCREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
What conditions are required for exploitation?
A client must connect to a hostile RDP server while parallel-device redirection is enabled. The server can then issue repeated CREATE requests through that redirected device channel.
Does exploitation require attacker privileges or user interaction?
The CVSS vector indicates no attacker privileges are required, but user interaction is required. In practice, this means a user must initiate or participate in an RDP connection to the hostile server.
How can I determine whether a deployment is in the affected range?
Check whether the FreeRDP version is 3.0.0 or later but earlier than 3.32.2, and whether parallel-device redirection is enabled. The Debian advisory lists both debian/freerdp3 and debian/freerdp2 as tracked software.