What is GHSA-33hw-q4mc-wxc2?

GHSA-33hw-q4mc-wxc2 is a security advisory published by GitHub Security Advisories with Medium severity. FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create...

Which CVE IDs does GHSA-33hw-q4mc-wxc2 cover?

GHSA-33hw-q4mc-wxc2 covers the following CVE IDs: CVE-2026-121391. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-33hw-q4mc-wxc2?

GHSA-33hw-q4mc-wxc2 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-33hw-q4mc-wxc2MediumCVSS 4.3

FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-121391 →

📋 Description

FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.

🔗 References (4)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8g9g-hqqp-fw69
https://nvd.nist.gov/vuln/detail/CVE-2026-121391
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-file-descriptor-exhaustion-via-parallel-create
https://github.com/advisories/GHSA-33hw-q4mc-wxc2