FreeRDP CVE-2026-121391

Exploitation requires BOTH (1) a user-initiated connection to a hostile or attacker-controlled RDP server, and (2) client-side parallel-device redirection explicitly enabled (e.g. /parallel:PRN,/dev/null) pointing to a local path that can actually be opened - this is a non-default configuration. When parallel redirection is disabled the code path is unreachable and the client is not exposed. Limiting factors that reduce real-world risk: mandatory user interaction to initiate the session (UI:P), the non-default redirection setting, and impact bounded to crashing the single FreeRDP client process on systems with a finite descriptor limit (observed first open failure at CREATE 98 under ulimit -n 128, CREATE 994 under ulimit -n 1024); no authentication bypass, TLS break, session theft, or host-wide outage was demonstrated.

This is a medium-severity, availability-only issue, not a high-impact priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L, 5.3) describes a network-reachable but user-interaction-dependent flaw that only crashes the FreeRDP client process; confidentiality and integrity are untouched (VC:N/VI:N). The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with a bounded denial-of-service. No EPSS probability was supplied and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A public proof-of-concept relay script is published inside the GHSA advisory and was used by the reporter (VulnCheck) to reproduce descriptor growth (~50→250 over 200 CREATE requests) and client segfaults under constrained ulimits, so exploit code is available but demonstrates DoS only - not code execution. The practical risk is further gated by two preconditions in the attacker's favor being absent in most deployments: the victim must initiate the connection AND must have explicitly enabled parallel-device redirection. One signal conflict to verify: the advisory's Impact narrative reasons in terms of 'UI:R' and 'A:H', but the authoritative CVSS 4.0 vector supplied shows UI:P and VA:L (partial/low availability impact scoped to the single client process) - the lower vector value should be treated as canonical, as the advisory itself states no host-wide outage was measured.

A user is lured or configured to connect their FreeRDP client, with parallel-device redirection explicitly enabled (e.g. /parallel:PRN,/dev/null), to an attacker-controlled or compromised RDP server. After the normal channel/RDPDR handshake, the hostile server repeatedly sends IRP_MJ_CREATE requests for the announced parallel device; each open leaks a file descriptor until the client's descriptor table is exhausted and the process segfaults. A working PoC relay demonstrating this is published in the GHSA advisory.