FreeRDP versions 3.0.0 through 3.32.1 contain a file descriptor leak in the function that handles parallel IRP_CREATE requests. The driver fails to close previously opened descriptors when it receives repeated IRP_MJ_CREATE messages, which a malicious server can exploit to deplete the client’s descriptor table. Exhaustion of descriptors causes the client process to crash, resulting in a denial of service for the user. This flaw is an example of a resource exhaustion weakness (CWE-772).

All FreeRDP clients ranging from 3.0.0 up to but not including 3.32.2 are affected. The vulnerability exists in the FreeRDP:FreeRDP product family and is relevant to any environment that uses the open‑source RDP client in its standard distribution.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. No EPSS score is available, and the bug is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. The likely attack vector is a hostile RDP server that has parallel-device redirection enabled; it can send repeated CREATE requests to the client, triggering the descriptor leak and causing the client to crash. The exploit requires the attacker to control the RDP server and enables denial of service via resource exhaustion on the client side.