CVE-2026-111378: FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected. Exposure requires a FreeRDP server endpoint that accepts network connections and reaches the NLA frame parser.
What does an attacker need to do to trigger the memory exhaustion?
No authentication or user interaction is required. An attacker can complete TLS and then send a byte stream whose data does not begin with the DER SEQUENCE tag 0x30, causing the receive buffer to grow without bound before NLA authentication.
What is the impact of successful exploitation?
The vulnerability can exhaust server memory, resulting in a denial of service. The provided scoring indicates availability impact only, with no stated confidentiality or integrity impact.
What version resolves the issue?
Upgrade to FreeRDP 3.32.0 or later. Versions before 3.32.0 in the affected 3.x range are vulnerable.