CVE-2026-121391Medium· 4.3▾ SunlitFreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled ca…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.
FreeRDP >= 3.0.0 < 3.32.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121950Medium· 6.5FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
CVE-2026-121951High· 7.5FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event
CVE-2026-121952Critical· 9.8FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability
CVE-2026-121953Critical· 9.8FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close
CVE-2026-121954Medium· 6.5FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec
CVE-2026-121957High· 7.5FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race