FreeRDP CVE-2026-121405

Requires a non-default redirection setup on the FreeRDP client: serial device redirection (RDPDR serial channel) must be enabled AND a redirected serial device must be successfully opened (a prior successful IRP_MJ_CREATE is a stated prerequisite). The victim must also initiate a connection to an attacker-controlled RDP server (UI:P / user-initiated session), so this cannot be triggered against a client that does not connect out or does not expose serial redirection. The trigger is a server-sent serial IRP_MJ_DEVICE_CONTROL carrying IOCTL_USBPRINT_GET_1284_ID with a near-maximum 32-bit OutputBufferLength (e.g. 0xFFFFFF00/0xFFFFFFFF). Limiting factors: no authentication to the client is needed but the attacker must control the server the victim connects to; impact is availability-only; the vendor observed that the maximal case exceeded the UINT32_MAX send guard and was not transmitted, and that tight process virtual-address limits yield clean STATUS_NO_MEMORY handling rather than exhaustion. Affected versions are FreeRDP <= 3.32.1; updating to 3.32.2 is the fix.

This is a medium-severity, availability-only denial-of-service flaw (CWE-770 uncapped allocation) and the signals are internally consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VA:L, score 5.3) describes a network-reachable but victim-initiated issue with no confidentiality or integrity impact and only limited availability impact - matching the GHSA description. No EPSS score and no CISA KEV entry are provided, and the vuln.today decision label is 'this_month' (not act_now/emergency), so there is no indication of active exploitation. The practical risk is bounded by preconditions and by the vendor's own measurements: exploitation requires the victim client to connect to an attacker-controlled server AND have serial device redirection enabled, and the advisory notes that the largest tested allocation (0xFFFFFFFF → ~4.01 GiB) produced a stream position beyond the production UINT32_MAX send guard and was not transmitted, while a near-maximum sendable case (0xFFFFFF00) was not observed to transmit over the network either. Net: a genuine resource-exhaustion bug worth patching on a normal cycle, not a high-CVSS/low-real-risk mislabel, but also not an emergency - the real-world outcome (full client memory exhaustion vs. a clean STATUS_NO_MEMORY) depends on the client's process memory limits, as the vendor itself demonstrated.

A user is lured into connecting their FreeRDP-based client (with serial port redirection enabled and a serial device opened) to an RDP server the attacker controls. The malicious server replies to the redirected serial channel with an IRP_MJ_DEVICE_CONTROL request using IOCTL_USBPRINT_GET_1284_ID and a near-maximum 32-bit OutputBufferLength, causing the client to allocate and fill multiple gigabytes of memory (~4 GiB measured) and potentially exhaust client memory. A public PoC reference exists in the GHSA advisory as a reproduction harness, but it is not verified as working remote exploit code - the vendor's own tests did not observe network transmission of the oversized response.