CVE-2026-110832: FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident memory growth and server resource exhaustion.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client that can open a Dynamic Virtual Channel (DVC) to a vulnerable FreeRDP server can trigger the memory exhaustion condition. No user interaction is required.
What does an attacker need to send?
The attacker sends a seven-byte DRDYNVC DATA_FIRST message on an opened DVC with a large declared 32-bit length. This causes the server to commit a large zeroed memory allocation.
Which versions are affected?
FreeRDP versions from 2.0.0 up to, but not including, 3.32.0 are affected.
What is the operational impact?
Repeated or sufficiently large allocations can exhaust server memory and cause resource exhaustion. The provided information identifies availability impact only; it does not indicate confidentiality or integrity impact.