CVE-2026-121403

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending a malformed drive redirection request with truncated data to a connected client. This request causes the client's drive background worker to exit unexpectedly while leaving the communication channel active. Consequently, subsequent incoming requests accumulate unbounded in memory, exhausting system resources and disrupting the active remote desktop session.

This vulnerability is rated as having a Moderate impact because it exclusively leads to client-side denial of service without permitting arbitrary code execution or privilege escalation. Exploitation requires a user to connect an affected client session to a malicious or compromised RDP server with drive redirection features actively utilized. Typical usage against trusted internal infrastructure remains unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not enable local drive redirection when initiating client connections (avoid using the /drive command-line option), and connect exclusively to trusted RDP hosts.

Caveats: Disabling drive redirection prevents sharing local storage devices or directories with the remote desktop environment. No system reload or service restart is required as this issue only affects client-side interactive sessions.