CVE-2026-109947
Received Received - Intake

Uncontrolled Resource Allocation in FreeRDP

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109947
EUVD
EUVD-2026-98712

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.20.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FreeRDP versions 3.20.1 through 3.31.0 allows a malicious RDP server to cause excessive memory consumption on the client by sending a specially crafted IRP_MJ_READ request with a Length value of 0xffffffff. On 64-bit systems, this causes an allocation of approximately 4 GiB of zeroed memory, while on 32-bit systems, it leads to an under-reserved buffer.

Detection Guidance

To detect this vulnerability, monitor FreeRDP client processes for excessive memory usage during RDP sessions with drive redirection enabled. Check for connections to untrusted RDP servers sending oversized IRP_MJ_READ requests. Use system monitoring tools like top, htop, or Windows Task Manager to observe memory consumption spikes in FreeRDP processes.

Impact Analysis

This vulnerability can cause denial of service by exhausting client memory, leading to crashes or system slowdowns. It requires the user to initiate an RDP connection with drive redirection enabled but does not need prior access or credentials.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.32.0 or later to patch the vulnerability. Disable drive redirection in RDP client settings if not required. Avoid connecting to untrusted RDP servers. Monitor network traffic for malformed IRP_MJ_READ requests with Length 0xffffffff.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109947. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart