Is CVE-2026-109947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109947 being exploited in the wild.

How severe is CVE-2026-109947?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

FreeRDP Project FreeRDP 3.20.1 to before 3.32.0.

Is there a fix for CVE-2026-109947?

Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109947 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109947?

Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109947: FreeRDP uncontrolled resource allocation in drive redirection

CVE-2026-109947 · Severity: medium · CVSS 6.5 · Published 2026-10-13

FreeRDP is a remote desktop client that allows users to connect to Windows systems over a network. A malicious or compromised RDP server can exploit a flaw in drive redirection to force a client's memory to be exhausted, causing the application to crash and denying service to the user. The attack requires only that the user enable drive sharing when connecting to the server.

Technologies: FreeRDP Project FreeRDP. Vendors: FreeRDP Project.

Quick answers

Is CVE-2026-109947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109947 being exploited in the wild.
How severe is CVE-2026-109947?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: FreeRDP Project FreeRDP 3.20.1 to before 3.32.0.
Is there a fix for CVE-2026-109947?: Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109947 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109947?: Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.32.0

Technical details

The vulnerability is an uncontrolled resource allocation (CWE-770) in the drive_process_irp_read function in channels/drive/client/drive_main.c. When processing an IRP_MJ_READ request with a maliciously large Length value (0xffffffff), the code calls Stream_EnsureRemainingCapacity with 4ull + Length, which on 64-bit builds requests ~4 GiB of memory that is then zeroed, while on 32-bit builds the allocation size wraps to a tiny value causing buffer underflow. The attack vector is network-based and requires user interaction to initiate an RDP connection with drive redirection enabled, but no further user action is needed once a shared file handle is obtained.

Affected products

FreeRDP Project FreeRDP 3.20.1 to before 3.32.0

Timeline

2026-09-29: disclosed
2026-10-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.