CVE-2026-110831

A flaw was found in FreeRDP. When a client connects to a malicious Remote Desktop Protocol (RDP) server with drive redirection enabled, the server can send a specially crafted request that triggers an error during file allocation. Because FreeRDP fails to release the opened local file when this operation fails, operating system file handles remain open until drive teardown. This issue can allow an attacker to cause resource exhaustion, potentially resulting in a Denial of Service (DoS) on the client system.

This flaw is rated Moderate because a file-handle leak during drive redirection can cause limited resource exhaustion (A:L) after the user connects with drive redirection enabled (UI:R).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict FreeRDP clients to trusted RDP servers and networks.