UBUNTU-CVE-2026-121403: Medium severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Ubuntu systems using FreeRDP through the freerdp2, freerdp3, or freerdp packages are affected if the FreeRDP version is earlier than 3.32.2 and the client processes drive device I/O requests.

What does an attacker need to exploit this issue?

An attacker needs to operate or control an RDP server that the victim connects to. The server sends a malformed drive DEVICE_IOREQUEST and then additional requests, so exploitation requires user interaction in the form of connecting to that server.

What is the practical impact?

The malformed request can terminate the drive worker without an error, while subsequent requests accumulate without bound in the IRP queue. This can exhaust memory and cause loss of availability for the affected RDP session.

UBUNTU-CVE-2026-121403: Medium severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact?