CVE-2026-121403
mediumFreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills th…
Vendor / product: Freerdp — freerdp
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.
CVSS
4.3
4.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-11-03 15:17
Modified: 2026-11-03 16:00
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-11-03 16:20 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
freerdp / freerdp <3.32.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5qqp-5ffm-m3p9 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-malformed... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 16:20 UTC · record ↗