CVE-2026-109947 FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read
A malicious RDP server can exhaust client memory by sending oversized drive redirection read requests, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109947?
CVE-2026-109947 is a high-severity denial of service vulnerability in Freerdp Freerdp, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.
Weakness: CWE-770
Which versions are affected by CVE-2026-109947?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-109947?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-109947 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109947 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-109947, GHSA-f7q2-5g46-x57m, GHSA-q56j-jjh6-38jf, UBUNTU-CVE-2026-109947.