Live › vulnerability › CVE-2026-121391
FreeRDP's parallel device redirection code fails to close file descriptors when a server sends repeated IRP_MJ_CREATE requests. A hostile RDP server can exhaust the client's descriptor table and crash the FreeRDP process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Only FreeRDP clients from 3.0.0 up to but not including 3.32.2 are affected, and only when parallel-device redirection is enabled. The attack needs a malicious RDP server the client connects to, so a team that only connects to trusted servers with redirection off can deprioritize it. Builds that embed FreeRDP as a library are affected too and need checking.
No product ranges from the sources yet.
xfreerdp --version or freerdp --version to find the installed FreeRDP version/parallel in the client command line) is enabled3.0.0 before : move to or later3.32.23.32.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121391")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.