Dashboard / CVE-2026-121403

CVE-2026-121403

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-03 Modified: 2026-11-09 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: None
VI: None
VA: Low

Description

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
FreeRDP FreeRDP 0 < 3.32.2
FreeRDP FreeRDP 0 < 3.32.2
freerdp freerdp < 3.32.2

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.23%
Raw Score 0.002340
Percentile 14.5%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00234
2026-11-13
0.00234
2026-11-12
0.00234
2026-11-10
0.00234
2026-11-09
0.00234
2026-11-08
0.00234
2026-11-07
0.00234
2026-11-06
0.00234
2026-11-05
0.00234
2026-11-04
0.00234

Intelligence Sources

mitre ref →
nvd ref →

External Links