Allocation of Resources Without Limits or Throttling in FreeRDP - #VU156159
Published: October 19, 2026
Vulnerability identifier: #VU156159
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by stopping the drive worker and causing subsequent requests to accumulate in memory.
The vulnerability exists due to improper error handling and allocation of resources without limits in FreeRDP's drive redirection worker when processing malformed server requests. A remote attacker can entice a victim to connect to a malicious RDP server, send a DEVICE_IOREQUEST with a valid 20-byte IRP header specifying IRP_MJ_CREATE but no CREATE body, and then send further requests to terminate the worker silently and accumulate queued requests without a consumer, causing session-scoped availability loss and potentially exhausting memory.
Affected software
FreeRDP
Remediation
Install security update from vendor's website.
FreeRDP - update to 3.32.2