CVE-2026-110831

medium

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictiona…

Vendor / product: Freerdp — freerdp

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.

CVSS

4.3

4.3 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)

Timeline (UTC)

Published: 2026-10-14 23:17

Modified: 2026-10-23 20:24

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-10-27 07:02 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

freerdp / freerdp ≥3.13.0 <3.32.0

Weakness classification (CWE)

CWE-775

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jgw9-wqvx-j495

Patch / mitigation: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jgw9-wqvx-j495

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jgw9-wqvx-j495 disclosure@vulncheck.com
https://www.vulncheck.com/advisories/freerdp-3.13.0-before-3.32.0-resource-leak-via-drive-... disclosure@vulncheck.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:02 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-110831

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs