DEBIAN-CVE-2026-121405: Medium severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a near-maximum length to exhaust client memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients before 3.32.2 are exposed when they connect to a malicious server that has serial redirection available. The affected Debian software entries are freerdp3 and freerdp2.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server and induce a client to connect to it. Exploitation requires the server to send a serial device-control IRP request using IOCTL_USBPRINT_GET_1284_ID with a near-maximum output-buffer length.
What is the likely impact on an affected client?
The malicious request can cause excessive memory allocation on the client, potentially exhausting available memory. The provided severity data indicates availability impact, with no stated confidentiality or integrity impact.
What can be done if updating is not immediately possible?
Avoid connecting affected FreeRDP clients to untrusted RDP servers, particularly servers that may use serial redirection. The provided data does not identify a more specific configuration workaround.