Live › vulnerability › CVE-2026-121405
FreeRDP before 3.32.2 does not cap the OutputBufferLength in serial device-control IRP requests. A malicious RDP server with serial redirection can make the client allocate excessive memory, exhausting it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams that build or ship the FreeRDP client, or run it to connect to RDP servers they do not fully trust. Exposure requires the server to use serial redirection; the sources do not say whether it is off by default. Teams connecting only to their own trusted servers can deprioritize.
No product ranges from the sources yet.
xfreerdp /version, and compare it with the fixed version.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length to exhaust client memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-121405")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.