UBUNTU-CVE-2026-121405: Medium severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a near-maximum length to exhaust client memory.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients before 3.32.2 are exposed when they connect to a malicious server that has serial redirection available. The affected Ubuntu software entries are freerdp2, freerdp3, and freerdp.

What does an attacker need to exploit the flaw?

An attacker must operate or control an RDP server that the victim connects to and send a serial device-control IRP request using IOCTL_USBPRINT_GET_1284_ID with a near-maximum OutputBufferLength. User interaction is required because the client must connect to the malicious server.

What is the impact and what should be done?

The malicious server can cause excessive memory allocation on the client, potentially exhausting client memory and causing a denial of service. Upgrade FreeRDP to version 3.32.2 or later.

UBUNTU-CVE-2026-121405: Medium severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact and what should be done?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact and what should be done?