Description
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
Published: 2026-10-14
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises because the FreeRDP client does not close prior serial handles in the serial_process_irp_create function. A RDP server could send repeated serial IRP_MJ_CREATE requests, forcing the client to consume increasing numbers of file descriptors until it exhausts its limit and fails the CommReadFile FD_SETSIZE assertion, resulting in a crash. This causes a denial of service but does not grant code execution or unauthorized access. The weakness is classified as CWE‑400.

Affected Systems

All FreeRDP installations built before version 3.32.0 are affected, regardless of operating system. No other vendors or products are listed.

Risk and Exploitability

The CVSS score assigned is 8.2, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers need only to run a malicious RDP server and establish a session with the vulnerable client; exploitation would involve repeatedly sending serial IRP_MJ_CREATE requests to deplete the client’s file descriptor table. The vulnerability is remotely exploitable and poses a significant availability risk to systems relying on FreeRDP.

Generated by OpenCVE AI on October 15, 2026 at 12:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.32.0 or later. This release closes the serial handle resource leak and restores correct descriptor management.
  • Disable or avoid use of the serial session feature if it is not required in your RDP sessions. By limiting the attack surface, you reduce the opportunity for descriptor exhaustion.
  • Implement network controls such as firewall rules or access lists to restrict connections to trusted RDP servers, thereby reducing the chance that an attacker can maintain a prolonged session that sends repeated create requests.

Generated by OpenCVE AI on October 15, 2026 at 12:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 14 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
Title FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-400
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T18:12:12.919Z

Reserved: 2026-10-14T22:11:15.574Z

Link: CVE-2026-110830

cve-icon Vulnrichment

Updated: 2026-10-15T18:11:54.090Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-14T23:17:22.737

Modified: 2026-10-23T20:23:29.300

Link: CVE-2026-110830

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-14T22:52:05Z

Links: CVE-2026-110830 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption