CVE-2026-111880: FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP deployments using versions from 2.0.0 up to, but not including, 3.32.0 are affected when they reach the server hash-callback NTLM authentication path.
What does an attacker need to exploit it?
The attacker does not need authentication or user interaction. Exploitation requires sending a crafted NTLM AUTHENTICATE_MESSAGE with a backward session-key offset and a MIC offset.
What is the impact of a successful exploit?
A successful crafted message causes a heap out-of-bounds write of 16 zero bytes beyond the allocation. The reported impact includes integrity and availability effects.
How can this be remediated?
Upgrade FreeRDP to version 3.32.0 or later. The affected range is stated as versions before 3.32.0 beginning with 2.0.0.