FreeRDP CVE-2026-109947

Exploitation requires that (1) the victim's FreeRDP client (3.20.1 up to but not including 3.32.0) initiates an RDP session to an attacker-controlled or compromised server, and (2) the drive redirection (rdpdr / drive channel) feature is active so the server can issue IRP_MJ_READ requests. The limiting factors are significant: the attacker must be the server (not an arbitrary network attacker), the user must be induced to connect (UI:P / user interaction), and drive redirection must be in use. The 32-bit vs 64-bit build affects the manifestation (full ~4 GiB allocation on 64-bit vs an under-reserved buffer on 32-bit). Impact is limited to denial of service - memory exhaustion/crash - with no confidentiality or integrity consequence.

This is a client-side denial-of-service flaw (CWE-770, uncontrolled resource allocation) in FreeRDP where a malicious or compromised RDP server can exhaust the memory of a connecting client. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly reflects the real nature of the risk: no confidentiality or integrity impact, only availability, and it requires passive user interaction (UI:P) - the victim must initiate a connection to the attacker-controlled server, making this an 'evil server' attack rather than an unauthenticated server-side RCE. The 7.1 score is driven almost entirely by the high availability impact (VA:H); there is no code execution. Exploitation status is 'no public exploit identified at time of analysis' - the CVE is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. EPSS is not supplied in the input and cannot be asserted. SSVC fields were not provided. Net assessment: a legitimately medium-to-high severity availability bug, but far from a top-tier emergency - it cannot be driven by an attacker against a client that never connects to a hostile server, and the impact is limited to a crash/memory exhaustion, not compromise. Note the directionality: although CVSS uses PR:N, the attacker is the SERVER and the victim is the client, so 'unauthenticated remote exploitation' in the conventional server-targeting sense does not apply here - verify this directional framing with the FreeRDP advisory before prioritizing network-perimeter mitigations.

A user is lured or redirected into connecting their FreeRDP-based client to an attacker-controlled RDP server (e.g., via a malicious .rdp file or a phishing link). Once the drive-redirection channel is negotiated, the server sends a crafted IRP_MJ_READ request with Length 0xffffffff, causing the client to attempt a ~4 GiB zeroed allocation on 64-bit builds (or an under-reserved buffer on 32-bit builds), exhausting memory and crashing or destabilizing the client. No public exploit code is referenced in the provided data.