CVE-2026-109947: FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-13 · updated 2026-10-21
Weakness: CWE-770

Description

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

Affected products

FreeRDP: from 3.20.1 before 3.32.0 — fixed in 3.32.0

How to fix

Upgrade to a fixed version: FreeRDP 3.32.0. Check the vendor advisory for mitigations.

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf
https://www.vulncheck.com/advisories/freerdp-3.20.1-before-3.32.0-unbounded-allocation-via-drive-process-irp-read
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf

Get alerted when CVE-2026-109947 or the next vulnerability affects your stack