CVE-2026-121403 in FreeRDP

Summary

by MITRE • 11/03/2026

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: VulnCheck
• Reservation: 11/03/2026
• Disclosure: 11/03/2026
• Moderation: accepted
• Entry: VDB-430316
• CPE: 20261103
• CWE: CWE-404 (confirmed)
• CVSS: 4.3 (CNA)
• EPSS: 0.00000
• KEV: no
• Activities: very low
• Sector: Government, Education, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-121403
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-121403
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-121403/