# CVE-2026-121405: FreeRDP memory exhaustion in serial device-control IRP

Source: https://junglewise.ai/threats/cve-2026-121405-freerdp-before-3-32-2-fails-to-cap-the-outputbufferlength-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121405 · Severity: medium · CVSS 4.3 · Published 2026-11-03

FreeRDP is a remote desktop protocol client used to connect to Windows systems. A malicious RDP server with serial device redirection enabled can exhaust a client's memory by sending a specially crafted request with an extremely large output buffer length, causing the client to allocate several gigabytes of RAM and potentially crash or freeze the session.

Technologies: [FreeRDP](https://junglewise.ai/threats/technologies/freerdp). Vendors: [FreeRDP](https://junglewise.ai/threats/vendors/freerdp).

## Quick answers

**Is CVE-2026-121405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121405 being exploited in the wild.

**How severe is CVE-2026-121405?** Medium severity, with a CVSS score of 4.3, published 3 November 2026.

**Which products and versions are affected?** FreeRDP before 3.32.2.

**Is there a fix for CVE-2026-121405?** Yes: fixed in 3.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121405 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121405?** Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.2

## Technical details

FreeRDP fails to validate or cap the OutputBufferLength parameter in serial IRP_MJ_DEVICE_CONTROL requests before allocating memory via calloc(). When a server sends a request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum 32-bit output length (e.g., 0xFFFFFFFF), the client allocates the full requested buffer even though the operation returns failure, and the response stream may commit several gigabytes. An attacker must establish an RDP connection with the client having serial redirection enabled.

## Affected products

- FreeRDP FreeRDP before 3.32.2

## Timeline

- 2026-10-19: disclosed
- 2026-10-19: patched

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r387-jjq3-87hv](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r387-jjq3-87hv)
- [https://www.vulncheck.com/advisories/freerdp-before-3.32.2-memory-exhaustion-via-serial-rdpdr-device-control](https://www.vulncheck.com/advisories/freerdp-before-3.32.2-memory-exhaustion-via-serial-rdpdr-device-control)

## Related threats

- [FreeRDP heap use-after-free in brush cache](https://junglewise.ai/threats/cve-2026-125394-freerdp-before-3-33-0-contains-a-heap-use-after-free)
- [FreeRDP heap buffer overflow in RD Gateway RPC client](https://junglewise.ai/threats/cve-2026-121964-freerdp-before-3-32-2-contains-a-heap-based-buffer-overflow-in)
- [FreeRDP use-after-free in dynamic rdpsnd channel](https://junglewise.ai/threats/cve-2026-121963-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in)
- [FreeRDP denial of service in NLA shadow server via malformed TSRequest](https://junglewise.ai/threats/cve-2026-121960-freerdp-before-3-32-2-contains-a-denial-of-service-vulnerability)
- [FreeRDP heap out-of-bounds write in RDPGFX HashTable_GetKeys](https://junglewise.ai/threats/cve-2026-121958-freerdp-through-3-32-1-has-a-heap-out-of-bounds-write-in-the)