CVE-2026-111377: FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client that can connect to the affected FreeRDP server can exploit it. The attacker needs to send data over a static virtual channel; no user interaction is required.
What behavior triggers memory exhaustion?
The client starts a static virtual-channel message, omits the LAST flag, and continues sending fragments. Because cumulative fragment limits are not enforced during reassembly, memory use can continue growing until the server is exhausted.
Which versions should be remediated?
FreeRDP versions from 2.0.0 up to, but not including, 3.32.0 are affected. Upgrade to 3.32.0 or later.