CVE-2026-110831

EUVD-2026-101714

14.10.2026, 23:17

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 13.3%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
freerdp	freerdp	3.13.0 ≤ 𝑥 < 3.32.0	CNA

Debian Releases

Debian Product

Codename

freerdp2

bookworm

vulnerable

freerdp3

forky	3.32.2+dfsg-1 fixed
sid	3.32.2+dfsg-1 fixed
trixie	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

freerdp

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

freerdp2

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	dne

freerdp3

jammy	dne
noble	needs-triage
resolute	needs-triage

Common Weakness Enumeration

CWE-775 - Missing Release of File Descriptor or Handle after Effective Lifetime
The software does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jgw9-wqvx-j495

https://www.vulncheck.com/advisories/freerdp-3.13.0-before-3.32.0-resource-leak-via-drive-redirection-irp-mj-create