Is CVE-2026-121403 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121403?

CVE-2026-121403 has a CVSS v3 severity of MEDIUM (4.3).

What does CVE-2026-121403 affect?

CVE-2026-121403 affects freerdp.

Back

CVE-2026-121403

Monitor on ThreatCluster

Description

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.