CVE-2026-109947

Freerdp: denial of service

Risk score: 48/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.3%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an…
Affected: Freerdp before 3.32.0
Fix: Upgrade Freerdp to 3.32.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWin…

The flaws

CVE-2026-109947: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-111375: Out-of-bounds read can lead to denial of service (CVSS 9.1 · EPSS 0%)
CVE-2026-111382: Out-of-bounds write can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-111380: Integer overflow (CVSS 8.8 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

Public proof of concept

Connects to

Same weakness: Denial of service (CWE-770). 202 other warnings in 30 days
Same product: Earlier Freerdp warnings. 29 in the last 90 days

Why it is Yellow

CVSS 6.5 medium
Public exploit or proof of concept referenced

References

Original description

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

Last activity 13 Oct 2026. Patch Forecast updates every hour.