UBUNTU-CVE-2026-121391: Medium severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallelprocessirpcreate that fails to close previous descriptors on repeated IRPMJCREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients in versions from 3.0.0 before 3.32.2 are exposed when they connect to a hostile RDP server and parallel-device redirection is enabled. The affected Ubuntu package names listed are freerdp2, freerdp3, and freerdp.

What does an attacker need to do to trigger the issue?

An attacker needs to operate or control an RDP server that a vulnerable client connects to. With parallel-device redirection enabled, the server can send repeated IRP_MJ_CREATE requests to leak descriptors until the client process crashes.

Is user interaction required?

Yes. The affected client must connect to the hostile RDP server. No attacker privileges on the client are indicated.

What is the impact of successful exploitation?

Repeated requests can exhaust the client's file descriptor table and crash the FreeRDP process. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.

UBUNTU-CVE-2026-121391: Medium severity ubuntu/freerdp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the issue?

Is user interaction required?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the issue?

Is user interaction required?

What is the impact of successful exploitation?