CVE-2026-109947

high

Description

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

References

https://www.vulncheck.com/advisories/freerdp-3.20.1-before-3.32.0-unbounded-allocation-via-drive-process-irp-read

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98712

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-14

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Severity: Medium

CVSS v4

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.0027