---
id: CVE-2026-109947
title: >-
  FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation
  vulnerability that allows malicious RDP servers to exhaust client memory via
  oversized drive redirection read requests
summary: >-
  FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation
  vulnerability that allows malicious RDP servers to exhaust client memory via
  oversized drive redirection read requests. Attackers can send IRP_MJ_READ with
  Le…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:17:32.993'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109947'
references:
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/freerdp-3.20.1-before-3.32.0-unbounded-allocation-via-drive-process-irp-read
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T14:29:01.851Z'
---

## Overview

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.