CVE-2026-110830

Executive Summary

CVE-2026-110830 is a resource-exhaustion (uncontrolled resource consumption) vulnerability in FreeRDP before version 3.32.0. The serial channel handler serial_process_irp_create fails to close previously opened serial handles, allowing a malicious or compromised RDP server to exhaust the client's file descriptors by sending repeated serial IRP_MJ_CREATE requests. Successful exploitation causes the FreeRDP client to terminate when a file-descriptor limit assertion (CommReadFile / FD_SETSIZE) is hit, producing a client-side denial of service. The flaw carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); no public PoC, exploit code, or KEV listing exists at the time of writing.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol, used both as a client (e.g., xfreerdp, wfreerdp) and in embedded/terminal-server contexts. The client is normally the "trusted" side of an RDP session, but a malicious, compromised, or attacker-controlled RDP server fully controls the data it sends to the client, making the client's server-facing parsing surface a legitimate attack surface.

The vulnerability resides in the serial device redirection channel. When the RDP server requests creation of a serial resource, the client's channel handler serial_process_irp_create is invoked. Per the NVD description, that handler fails to close prior serial handles before servicing subsequent create requests. Each repeated serial IRP_MJ_CREATE (an I/O request packet corresponding to the "create" major function) therefore accumulates an open file descriptor (or handle) on the client host without releasing the previous one.

The root cause is a handle/descriptor lifecycle defect — an uncontrolled resource consumption pattern classified as CWE-400. The descriptor pool is a finite, process-wide (in some builds, system-wide) resource. When the accumulated descriptors reach the limit checked by the CommReadFile function against FD_SETSIZE, an assertion fails and the client process terminates. FD_SETSIZE is the compile-time maximum number of file descriptors that select()-based code (of which CommReadFile is part) can monitor; once the process's descriptor count saturates that bound, the client is no longer able to service its I/O loop.

Key characteristics of the mechanism:

• Trigger: repeated serial create IRPs from the server side of the RDP session.
• Accumulation: handles are opened but not closed on subsequent create operations, so growth is monotonic.
• Failure mode: process abort via an assertion in the CommReadFile/FD_SETSIZE path (denial of service), not memory corruption or code execution.
• Locality: the defect executes in the client's serial channel handler; the attacker operates the server endpoint.

No further code-level specifics (exact descriptor types, per-handle off-by-one, or whether a partial close exists in adjacent code paths) can be stated beyond what the description provides; no public proof-of-concept or patch diff is available to confirm implementation detail.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only the identifiers present in the description (serial_process_irp_create, IRP_MJ_CREATE, CommReadFile, FD_SETSIZE) are used.

1. Reconnaissance / target identification. An attacker who can act as the RDP server endpoint (via a malicious server, a compromised or attacker-operated RDP host, or a machine-in-the-middle positioned to impersonate a server) identifies FreeRDP-based clients that will connect to it. Such clients are commonly desktop RDP users, thin/terminal clients, and automation that initiates outbound RDP sessions to a nominated server. The relevant surface is the serial channel negotiated during session setup; where serial redirection is enabled, the channel is present.

2. Triggering the flaw class. Once the RDP session and serial channel are established, the malicious server sends serial I/O requests corresponding to IRP_MJ_CREATE. The client processes each through serial_process_irp_create. Because the handler does not close the previously opened serial handle, each create request leaves an additional handle/descriptor open. Repeating the create requests increases the client's open-descriptor count.

3. Execution / payload at the vulnerability-class level. The "payload" is not code but a sustained sequence of serial IRP_MJ_CREATE requests — a resource-exhaustion flood. There is no memory-safety exploitation; success depends on the attacker driving enough create operations to accumulate descriptors until the count reaches the FD_SETSIZE boundary enforced in the CommReadFile path, at which point the client aborts.

4. Post-exploitation impact. The observable outcome is termination of the FreeRDP client via the assertion failure in CommReadFile. This is a client-side denial of service: the user loses their RDP session and, if the client is repeatedly re-established against the same malicious server, the condition can recur, causing a persistent denial of service for that client. There is no evidence in the provided data of privilege escalation, data confidentiality impact, or integrity impact (CVSS C:N/I:N/A:H), and no lateral movement is implied by the mechanics.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base score 5.9 (Medium).

• Attack Vector — Network (N): the input arrives over the RDP session, i.e., across the network from the server endpoint.
• Attack Complexity — High (H): exploitation requires the attacker to be the server endpoint (or able to impersonate one), the serial channel to be active, and a sufficient volume of serial create requests to reach the descriptor ceiling — non-trivial positioning and sustained request volume.
• Privileges Required — None (N): no privileges on the client are needed; the flaw is triggered from the server side.
• User Interaction — None (N) per vector: no additional user action beyond the RDP connection itself is modeled. (In practice the user must have initiated/held the session, but the vector specifies no distinct interaction requirement.)
• Scope — Unchanged (U): the impact is confined to the vulnerable client process.
• Confidentiality — None (C:N) / Integrity — None (I:N): no disclosure or modification of data is described.
• Availability — High (A:H): the client is terminated (assertion failure), constituting a loss of availability for the client component.

Blast radius and business impact. The affected component is the FreeRDP client on endpoints that connect to RDP servers, especially deployments with serial/device redirection enabled (industrial, kiosk, thin-client, and lab environments). Because the trigger originates from the server side, an attacker controlling an RDP server — or an on-path adversary — can cause client crashes. Business impact includes disruptive session loss, potential repeatable DoS against a client that reconnects to the same server, and reduced reliability of FreeRDP-based automation that initiates outbound RDP connections. There is no server-side exposure described. EPSS has not yet assigned a score (not scored by FIRST.org), and the CVE is not in CISA KEV; there is no evidence of active exploitation.

Detection Guidance

Detection should focus on (a) client-side abnormal termination associated with RDP serial channel activity and the FD_SETSIZE/CommReadFile assertion, and (b) unusually high volumes of RDP serial-channel create activity from a server to a client. Because serial-channel payloads are encapsulated in the RDP channel stream, network detection is best-effort and should be combined with host telemetry.

Sigma Rule

title: FreeRDP Client Termination via Serial Handle Exhaustion (CVE-2026-110830)
id: 9f2c1a74-6b3e-4d6a-8f21-0a1c4e7b5d10
status: experimental
description: Detects FreeRDP client crashes/aborts consistent with serial handle descriptor exhaustion and the CommReadFile FD_SETSIZE assertion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110830
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/xfreerdp'
      - '/wfreerdp'
  selection_crash:
    CommandLine|contains:
      - 'FD_SETSIZE'
      - 'CommReadFile'
  condition: selection_proc and selection_crash
falsepositives:
  - Debug builds printing diagnostics that reference FD_SETSIZE
level: medium
tags:
  - attack.t1499
  - cve.2026.110830

YARA Rule

rule CVE_2026_110830_FreeRDP_Serial_FD_Exhaustion_Marker
{
    meta:
        description = "Detects FreeRDP binaries/strings associated with serial handle leak and FD_SETSIZE assertion"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110830"
        date = "2026-01-01"
        hash = ""
    strings:
        $s1 = "serial_process_irp_create" ascii
        $s2 = "CommReadFile" ascii
        $s3 = "FD_SETSIZE" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of ($s1, $s2, $s3)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-110830 Possible FreeRDP Serial Handle Exhaustion - High Volume Serial Channel Create"; flow:established,to_client; content:"|03 00|"; depth:2; dsize:>0; threshold:type both, track by_src, count 500, seconds 60; classtype:attempted-dos; reference:cve,2026-110830; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110830; sid:2026110830; rev:1;)

Note: RDP serial channel traffic is multiplexed and often TLS-protected; this rule is a heuristic anomaly signal based on sustained server-to-client RDP data volume and should be tuned. Generic high-volume RDP DoS patterns generate false positives.

Elastic Detection

sequence by process.entity_id with maxspan=10m
  [process where process.name in ("xfreerdp","wfreerdp")]
  [process where event.action == "end"
     and process.name in ("xfreerdp","wfreerdp")
     and (process.exit_code != 0 or process.args : "*FD_SETSIZE*")]

Purpose: correlate a running FreeRDP client with its non-zero/abnormal termination, consistent with the CommReadFile/FD_SETSIZE assertion described for this CVE.

Splunk SPL Query

index=endpoint OR index=syslog
(sourcetype=linux_audit OR sourcetype=syslog)
(image="*xfreerdp" OR image="*wfreerdp" OR process_name="*freerdp*")
("FD_SETSIZE" OR "CommReadFile" OR "Assertion" OR "assert")
| stats count values(message) as messages by host, image, process_name
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-110830,">
  <rule id="110830" level="7">
    <decoded_as>syslog</decoded_as>
    <match>xfreerdp|wfreerdp|CommReadFile|FD_SETSIZE</match>
    <description>Possible FreeRDP serial handle exhaustion (CVE-2026-110830): client assertion/termination referencing FD_SETSIZE or CommReadFile.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict the RDP servers a FreeRDP-based client is permitted to connect to; connect only to trusted, administered servers. Since the trigger is server-side, limiting the set of reachable servers reduces exposure to malicious or compromised endpoints.
• Where serial/device redirection is not required, disable the serial channel to remove the vulnerable handler from the negotiated surface. (Validate against your FreeRDP build's channel configuration options.)
• Monitor client processes for abnormal termination and for the CommReadFile/FD_SETSIZE assertion; alert and investigate repeated client restarts against a specific server.
• Treat untrusted or attacker-influenced RDP servers as hostile endpoints; consider network segmentation and egress control for outbound RDP.

2. Patch / upgrade steps

• Upgrade the FreeRDP client to version 3.32.0 or later, which per the description corrects the handling so prior serial handles are closed in serial_process_irp_create.
• Verify package provenance and rebuild/redeploy xfreerdp/wfreerdp and any embedded FreeRDP-based clients. Confirm the deployed binary version reports 3.32.0+.
• Because Patch Confidence is 0/4 and no vendor advisory/patch source is recorded, confirm the fix against the upstream FreeRDP release before relying on it as the sole control.

3. Long-term hardening

• Maintain an inventory of FreeRDP client deployments and enforce a routine update cadence for RDP clients, not just servers.
• Apply least-functionality defaults: disable unused RDP channels (serial, drive, printer redirection) in managed configurations.
• Add resource-limit guardrails at the OS level (e.g., process file-descriptor limits via ulimit/systemd LimitNOFILE) to bound the impact of descriptor-exhaustion classes and surface failures earlier for monitoring.
• Incorporate RDP client liveness monitoring to detect crash loops and correlate them with the serving endpoint.

References

• NVD — CVE-2026-110830: https://nvd.nist.gov/vuln/detail/CVE-2026-110830
• FreeRDP project (source and releases): https://github.com/FreeRDP/FreeRDP
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities catalog (verify status; CVE-2026-110830 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploitation evidence: no public PoC, no exploit code, no Nuclei template, and no threat-actor campaign is associated with CVE-2026-110830 in the provided data. EPSS has not yet assigned a score.