CVE-2026-111377: FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

Q: Who can exploit this issue?

An authenticated client that can connect to the affected FreeRDP server can exploit it. The attacker needs to send data over a static virtual channel; no user interaction is required.

Q: What behavior triggers memory exhaustion?

The client starts a static virtual-channel message, omits the LAST flag, and continues sending fragments. Because cumulative fragment limits are not enforced during reassembly, memory use can continue growing until the server is exhausted.

Q: Which versions should be remediated?

FreeRDP versions from 2.0.0 up to, but not including, 3.32.0 are affected. Upgrade to 3.32.0 or later.

Published Oct 16, 2026

Updated

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

Affected Software

1 affected component

FreeRDP freerdp>=2.0.0<3.32.0

Event History

Oct 16, 2026

CVE Published

via MITRE·01:17 AM

Data Sourced

via MITRE·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated client that can connect to the affected FreeRDP server can exploit it. The attacker needs to send data over a static virtual channel; no user interaction is required.

What behavior triggers memory exhaustion?

The client starts a static virtual-channel message, omits the LAST flag, and continues sending fragments. Because cumulative fragment limits are not enforced during reassembly, memory use can continue growing until the server is exhausted.

Which versions should be remediated?

FreeRDP versions from 2.0.0 up to, but not including, 3.32.0 are affected. Upgrade to 3.32.0 or later.

CVE-2026-111377: FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What behavior triggers memory exhaustion?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What behavior triggers memory exhaustion?

Which versions should be remediated?