CVE-2026-109947

EUVD-2026-98712
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.83%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
freerdpfreerdp
3.20.1 ≤
𝑥
< 3.32.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
vulnerable
freerdp3
forky
3.32.1+dfsg-1
fixed
sid
3.32.2+dfsg-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf
https://www.vulncheck.com/advisories/freerdp-3.20.1-before-3.32.0-unbounded-allocation-via-drive-process-irp-read