CVE-2026-110831 in FreeRDP
Summary
by MITRE • 10/15/2026
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
FreeRDP versions 3.13.0 through 3.32.0 contain a critical resource retention flaw within the drive_process_irp_create function that facilitates local information disclosure and potential denial of service conditions. This vulnerability stems from an improper handling sequence during the initialization of file operations for redirected drives, specifically when processing IRP_MJ_CREATE requests originating from remote RDP servers. The core technical deficiency lies in the order of operations performed by the client-side implementation: the software registers a newly opened local file into its internal drive dictionary before validating and applying the requested allocation size parameters. This architectural decision creates a race condition-like state where resources are committed to active management structures prior to confirming their validity or feasibility for use.
The exploitation vector involves a malicious RDP server actively connected to an affected FreeRDP client that has drive redirection enabled, such as local disk access mapped over the remote desktop protocol session. By sending an IRP_MJ_CREATE request with the AllocationSize field set to UINT64_MAX, which represents the maximum possible value for a 64-bit unsigned integer, the attacker forces the underlying file system seek operation to fail due to invalid or excessive size constraints. Under normal circumstances, this failure should trigger a cleanup routine that reverses any prior state changes and closes associated handles. However, because the file was already registered in the drive dictionary before the allocation check occurred, the subsequent error path fails to remove this entry from memory.
This oversight results in a persistent leak of both the file object reference and the underlying operating-system handle until the entire drive redirection subsystem is torn down or the session ends. From an information disclosure perspective, while the immediate impact may appear limited to resource exhaustion, the retention of these handles can expose sensitive metadata about local files that were attempted to be accessed. In more severe scenarios involving repeated exploitation attempts, this behavior contributes directly to a denial of service condition by gradually consuming system resources such as file descriptors and memory allocations associated with handle management structures. Over time, this accumulation can degrade client performance or cause the FreeRDP application to become unresponsive if resource limits are reached.
The vulnerability aligns closely with CWE-401, which describes missing release of a resource after effective use, often referred to as a memory leak in broader contexts but specifically manifesting here as handle and object retention. It also maps to ATT&CK technique T1537, involving data transfer from the victim system, although primarily through indirect means via state manipulation rather than direct exfiltration tools. The flaw highlights a common pitfall in systems programming where error handling paths do not fully reverse all side effects of successful preliminary steps.
Mitigation strategies require immediate patching to versions 3.32.0 or later, which correct the execution order by validating allocation sizes before registering files in the drive dictionary and ensuring proper cleanup on failure. Administrators should enforce strict network segmentation policies to prevent untrusted RDP servers from connecting to internal clients with drive redirection enabled. Additionally, implementing least-privilege principles for FreeRDP processes can limit the impact of any potential handle exhaustion by restricting access to critical system resources. Regular auditing of open file handles and monitoring for abnormal resource consumption patterns in environments where remote desktop services are prevalent will aid in early detection of such exploitation attempts.