FreeRDP EUVD-2026-101713

Exploitation requires (1) the FreeRDP client to have serial/COM port device redirection enabled (the serial channel that handles IRP_MJ_CREATE must be active - this is a non-default feature that must be explicitly configured), and (2) the victim client to connect to an attacker-controlled or compromised RDP server, since this is a malicious-server attack against the client rather than a server-side flaw. Limiting factors: the attacker must control the RDP server the victim connects to, the serial redirection channel must be in use, and the only achievable outcome is client termination (availability loss) - there is no code execution or data disclosure. The CVSS AC:H and AT:P reflect these conditions. Affected versions are all FreeRDP releases before 3.32.0.

This is a high-scoring (CVSS 4.0 base 8.2) but narrowly-scoped vulnerability whose severity is driven almost entirely by a single availability impact (VA:H), with no confidentiality or integrity impact (VC:N/VI:N). The CVSS vector itself tempers the network attack vector (AV:N) with high attack complexity (AC:H) and a present attack requirement (AT:P), reflecting that exploitation is not trivial and depends on conditions outside the attacker's sole control - namely that the victim's FreeRDP client connects to the attacker's server with serial device redirection active. PR:N/UI:N in the vendor vector indicate no authentication, but note this is a CLIENT-side flaw triggered by a malicious SERVER, so in practice the victim must initiate or be induced to initiate the connection. EPSS score is NOT provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced - no public exploit identified at time of analysis. Net assessment: this is a genuine, vendor-confirmed denial-of-service bug (resource exhaustion, CWE-400) but it is a lower real-world priority than the 8.2 suggests - the impact is a client crash, not RCE or data exposure, and it requires a non-default feature plus a hostile server. Prioritize patching for environments that enable serial redirection and connect to untrusted RDP endpoints; otherwise treat as medium operational urgency.

A user running a FreeRDP-based client (version before 3.32.0) with serial port redirection enabled connects to an attacker-controlled or compromised RDP server. The malicious server repeatedly issues serial IRP_MJ_CREATE requests; because prior serial handles are never closed in serial_process_irp_create, open file descriptors accumulate until the client hits the CommReadFile FD_SETSIZE assertion and terminates. No public proof-of-concept is referenced in the provided data.