CVE-2026-110831

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive process irp create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP MJ CREATE with AllocationSize set to UINT64 MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.