FreeRDP Before 3.32.0 Flaw Allows Remote Servers to Crash Client Apps
A high-severity flaw in older FreeRDP builds lets malicious servers exhaust file descriptors, forcing client termination via repeated serial port requests.
Key points
- FreeRDP versions prior to 3.32.0 are vulnerable to a denial-of-service attack.
- The flaw allows a malicious server to exhaust client file descriptors.
- CVE-2026-110830 is rated CVSS 8.2 HIGH due to resource exhaustion.
FreeRDP versions older than 3.32.0 are vulnerable to a denial-of-service issue that allows a malicious Remote Desktop Protocol server to force the client application to shut down. The flaw stems from the client’s failure to close previous serial port handles when processing new connections. This oversight enables an attacker to accumulate open file descriptors until the client hits a system limit and terminates.
How it unfolded
- The vulnerability was identified as CVE-2026-110830 by the National Vulnerability Database.
- The flaw exists in the `serial_process_irp_create` function of affected FreeRDP builds.
- Attackers exploit the issue by sending repeated `IRP_MJ_CREATE` requests to exhaust resources.
Who is affected
Organizations using FreeRDP clients with versions earlier than 3.32.0 face exposure to this flaw. The National Vulnerability Database assigns the vulnerability a CVSS score of 8.2, categorizing it as HIGH severity. The underlying weakness is classified under CWE-400, which covers unrestricted resource consumption. This issue specifically impacts the client side of the connection, rather than the server hosting the remote session.
Our take on the response
The severity rating reflects the ease with which a remote server can trigger a client crash. Unlike the Parse Server issue Patch Observer reported on 2026-10-16, where unhandled email errors crashed processes, this flaw relies on serial port handle leakage. The impact is localized to the client machine, but widespread use of FreeRDP means many endpoints could be affected simultaneously if they connect to a compromised or malicious RDP host.
Who needs to act first
Teams should prioritize updating exposed endpoints that connect to untrusted or public RDP servers. Before deploying updates, verify compatibility with existing automation scripts and user profiles. Back up current configurations to prevent data loss during the upgrade process. If immediate patching is not possible, restrict connections to known, trusted internal servers only. Monitor client logs for unusual serial port activity or repeated connection attempts that might indicate exploitation attempts.
What to do and how to stay safe: FreeRDP
- Inventory all systems running FreeRDP and identify versions older than 3.32.0.
- Schedule an update to version 3.32.0 or later as soon as maintenance windows allow.
- Monitor client application logs for signs of file descriptor exhaustion or unexpected terminations.
- Restrict user access to unknown or external RDP servers until patches are applied.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific FreeRDP versions are vulnerable to CVE-2026-110830?
All FreeRDP versions prior to 3.32.0 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-110830 as 8.2, which is HIGH severity.
How does an attacker exploit this flaw?
Attackers send repeated serial IRP_MJ_CREATE requests to exhaust file descriptors on the client.
