CVE-2026-121391 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within FreeRDP versions 3.0.0 through 3.32.1 represents a critical resource management flaw located in the parallel_process_irp_create function, which handles Input/Output Request Packets for device redirection over Remote Desktop Protocol connections. This specific defect is classified as an improper resource shutdown or release error, aligning with Common Weakness Enumeration identifier CWE-775. The core technical issue arises when a client receives repeated IRP_MJ_CREATE requests from a remote server while parallel-device redirection features are enabled. In these scenarios, the application fails to properly close or deallocate file descriptors associated with previous connection attempts before initializing new ones. This oversight results in a progressive accumulation of open file descriptor handles that remain allocated within the operating system's process table but serve no functional purpose after the initial request is superseded by subsequent requests.
From an operational perspective, this flaw enables a denial-of-service attack vector where a malicious RDP server can systematically exhaust the client machine's available file descriptors. By continuously sending CREATE requests without allowing for proper cleanup of prior resources, the attacker forces the FreeRDP process to consume increasing amounts of system memory and handle table entries until no further descriptors are available. Once the limit is reached, typically defined by the operating system's per-process or global limits on open files, the application becomes unable to perform any new I/O operations. This state effectively crashes the RDP client process, disrupting the remote session and potentially causing instability in other applications running on the same host that rely on file descriptor availability for normal operation.
This vulnerability maps directly to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-technique of resource exhaustion via application layer protocols. The attack does not require code execution or privilege escalation but instead leverages legitimate protocol functionality in a malicious manner to degrade service availability. The impact is strictly limited to denial-of-service for the affected client instance and potentially broader system instability if other critical services are starved of resources due to the high consumption by the vulnerable FreeRDP process.
Mitigation strategies primarily involve upgrading to FreeRDP version 3.32.2 or later, where this resource leak has been addressed through corrected lifecycle management in the parallel device redirection module. Until an upgrade is feasible, administrators should restrict access to RDP servers that are not fully trusted and consider implementing network-level monitoring to detect anomalous patterns of rapid IRP_MJ_CREATE requests from single sources. Additionally, configuring operating system limits on open file descriptors can provide a partial buffer against total process failure, though this does not resolve the underlying application defect or prevent service disruption within the FreeRDP context itself.