CVE-2026-110831GHSA-jgw9-wqvx-j495

FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE

FreeRDP FreeRDP

CVSS

5.3Medium

ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List

Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.32.0Fixed versionCVE List

Published14 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

3.32.0FreeRDPCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-110831 FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the Telegram: CVE Notify, 23 Oct 2026

Description

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.

Text from CVE List

Affected versions 2

FreeRDPaffected: 3.13.0 before 3.32.0CVE List
FreeRDPunaffected: 3.32.0CVE List