CVE-2026-110830 in FreeRDP
Summary
by MITRE • 10/15/2026
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a significant resource management flaw within the Remote Desktop Protocol implementation, specifically affecting the handling of serial port redirection features. This issue stems from an improper lifecycle management mechanism for file descriptors associated with virtual serial ports during client-server interactions. When a remote desktop session is established and configured to redirect local serial devices to the remote server, FreeRDP creates corresponding handle objects on the client side to facilitate data exchange. The core technical deficiency lies in the serial_process_irp_create function, which processes Input/Output Request Packets (IRPs) sent by the RDP server to create or open these virtual serial port handles. Under normal operational conditions, when a connection is closed or reconfigured, these handles should be properly released and their underlying file descriptors closed to free up system resources. However, in vulnerable versions of FreeRDP, this cleanup process fails to execute correctly upon subsequent creation requests for the same logical device.
This failure results in a classic resource leak scenario where each new IRP_MJ_CREATE request sent by a malicious or misconfigured RDP server causes the client application to allocate additional file descriptors without releasing those from previous iterations of the connection lifecycle. As an attacker can control the frequency and volume of these requests, they are able to systematically exhaust the available file descriptor space on the target system. Operating systems impose strict limits on the number of open files or sockets a single process may hold at any given time, often defined by constants such as FD_SETSIZE in Unix-like environments or similar per-process limits in Windows. By repeatedly sending serial IRP_MJ_CREATE requests without allowing for proper handle closure, an attacker can rapidly consume these limited resources until the system reaches its threshold.
The operational impact of this vulnerability is primarily a denial-of-service condition against the FreeRDP client application itself rather than the underlying operating system or network infrastructure. Once the accumulation of unclosed file descriptors exceeds the maximum allowed limit for the process, the application encounters critical errors during subsequent I/O operations. Specifically, the code triggers an assertion failure at CommReadFile when it attempts to perform a select operation on a set that has exceeded FD_SETSIZE limits. This assertion failure typically results in the immediate termination of the FreeRDP client process. Consequently, legitimate users are abruptly disconnected from their remote desktop sessions, and any unsaved work or active processes within those sessions may be lost depending on how gracefully the application handles such abrupt terminations. While this does not directly lead to arbitrary code execution or privilege escalation, it effectively disrupts availability for anyone relying on serial port redirection features through FreeRDP.
From a classification perspective, this vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling and CWE-401: Missing Release of Memory after Effective Lifetime. The lack of proper resource deallocation constitutes an improper cleanup mechanism that allows for gradual degradation of system stability. In terms of the MITRE ATT&CK framework, this behavior is consistent with techniques related to Resource Hijacking and Denial of Service, specifically where an adversary manipulates local resources to disrupt service availability. Although typically categorized as a client-side vulnerability, it highlights the importance of robust input validation and state management in network-facing applications that handle dynamic resource allocation based on remote inputs.
Mitigation strategies for this issue involve upgrading FreeRDP to version 3.32.0 or later, where the developers have addressed the serial handle lifecycle issues by ensuring proper closure of prior handles before allocating new ones during IRP processing. Administrators should also consider implementing network-level access controls to restrict which RDP servers can initiate connections with clients configured for serial redirection, thereby reducing the attack surface. Additionally, monitoring client-side resource usage metrics such as open file descriptor counts in production environments running older versions of FreeRDP can provide early warning indicators of potential exploitation attempts before a full denial-of-service event occurs. Until patches are applied, disabling serial port redirection features if they are not strictly required for business operations serves as an effective compensating control to prevent this specific vector from being exploited.