CVE-2026-110833: FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions from 3.0.0-beta1 through versions before 3.32.0 are affected when handling RDPDR channel fragments in the proxy. The issue is per session and can exhaust proxy memory.
What does an attacker need to do to trigger the memory exhaustion?
An attacker needs network access to send crafted RDPDR proxy traffic. They send a FIRST fragment and then continuation fragments without a LAST fragment, causing the session heap stream to grow with incoming traffic.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates no privileges and no user interaction are required, although exploitation has high attack complexity.
What is the impact if exploitation succeeds?
The vulnerability affects availability: retained fragment data can grow until proxy memory is exhausted. No confidentiality or integrity impact is indicated.