CVE-2026-121403 — 脆弱性インテリジェンス

freerdp — freerdp

公表日: 2026-11-03T15:17:28.703

CVSS

5.3

CISA KEV

未掲載（悪用がないことを意味しません）

情報源の原文（翻訳ではありません）

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.

情報源

• CVE-2026-121403
• Vendor Advisory
• Third Party Advisory