Medium severity4.3NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026
CVE-2026-121403
CVE-2026-121403
Description
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5qqp-5ffm-m3p9nvdVendor Advisory
- www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-malformed-drive-irpnvdThird Party Advisory
News mentions
0No linked articles in our index yet.