CVE-2026-121405 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length to exhaust client memory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical resource exhaustion flaw rooted in the handling of serial device-control Input/Output Control (IOCTL) requests during remote desktop sessions involving USB or serial redirection. This issue specifically affects the client-side implementation when interacting with malicious servers that exploit the lack of bounds checking on buffer lengths within specific control codes, most notably IOCTL_USBPRINT_GET_1284_ID. In normal operational scenarios, FreeRDP facilitates the redirection of peripheral devices from a remote server to the local client machine, allowing users to interact with USB printers or serial ports as if they were locally attached. However, this convenience feature introduces an attack surface where the integrity and size of data buffers exchanged between the client and server must be strictly validated. The flaw arises because the application fails to cap the OutputBufferLength parameter associated with these IRP_MJ_DEVICE_CONTROL requests, thereby trusting potentially untrusted input from the remote endpoint without sufficient verification against system limits or reasonable maximums for such operations.
From a technical perspective, this vulnerability is classified under CWE-789: Memory Allocation with Excessive Size Value, which describes scenarios where software allocates memory based on an externally influenced size that exceeds expected bounds. When a malicious server sends an IRP_MJ_DEVICE_CONTROL request containing the IOCTL_USBPRINT_GET_1284_ID code along with a near-maximum length value for the output buffer, FreeRDP attempts to allocate a corresponding amount of heap memory to store the response data. Because there is no upper limit enforced on this allocation relative to realistic expectations for such device queries, the client process can trigger massive memory consumption. This behavior effectively transforms a standard protocol interaction into a mechanism for rapid resource depletion, as the operating system's memory manager attempts to satisfy these increasingly large requests until available physical and virtual memory are exhausted or the application is terminated by the OS due to out-of-memory conditions.
The operational impact of this vulnerability is severe, primarily manifesting as a Denial of Service against the FreeRDP client host. By repeatedly sending crafted IOCTL_USBPRINT_GET_1284_ID requests with excessive buffer lengths, an attacker can cause the victim's system memory usage to spike dramatically. This leads to significant performance degradation for other processes running on the same machine, potential crashes of the remote desktop session, and in worst-case scenarios, a complete system hang or reboot if critical services are starved of resources. Unlike vulnerabilities that allow code execution, this flaw is strictly exploitable for resource exhaustion, making it particularly dangerous in multi-tenant environments or when users connect to untrusted public virtual desktop infrastructure where server-side compromise could lead directly to client instability and operational disruption.
This vulnerability aligns with the MITRE ATT&CK framework technique T1496: Resource Hijacking, specifically under sub-techniques related to CPU or Memory Consumption. Attackers can leverage this flaw as part of a broader campaign to disrupt availability without needing elevated privileges on the target system beyond what is required for establishing an RDP connection with USB redirection enabled. The exploitation vector requires network access and typically involves convincing a user to connect to a malicious FreeRDP server, highlighting the importance of verifying the trustworthiness of remote endpoints in enterprise environments where peripheral redirection features are frequently utilized for productivity enhancements.
Mitigation strategies focus primarily on upgrading the FreeRDP client software to version 3.32.2 or later, where developers have implemented proper bounds checking and validation logic for output buffer lengths in serial device-control requests. Administrators should also consider disabling USB and serial redirection capabilities within group policies if these features are not strictly required by their workflow, thereby reducing the attack surface entirely. Additionally, implementing network-level authentication and ensuring that only authorized servers can initiate connections with peripheral redirection enabled adds a layer of defense-in-depth. Security teams should monitor for unusual spikes in memory consumption associated with rdpclip.exe or related FreeRDP processes, as this may indicate an ongoing exploitation attempt targeting this specific flaw before patches are applied across the organization.