FreeRDP CVE-2026-110832

Requires an authenticated client (CVSS PR:L) that has established an RDP session and successfully opened a dynamic virtual channel (DVC) on a FreeRDP server running 2.0.0 up to but not including 3.32.0; the attacker then sends a crafted seven-byte DATA_FIRST message on that DVC declaring an inflated 32-bit length, causing the server to pre-commit a large zeroed resident-memory allocation. Exploitation is LIMITED by the need for valid authentication and an opened DVC - it is not remote-unauthenticated - so exposure depends on who can authenticate to the RDP service; no special non-default configuration or user interaction is otherwise required, and impact is availability-only (memory/resource exhaustion).

This is a moderate-severity, availability-only denial-of-service issue (CWE-400 resource exhaustion), not a code-execution or data-disclosure flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, score 7.1) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring low-level privileges (PR:L) because the attacker must be an authenticated client that has already established an RDP session and opened a dynamic virtual channel. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The signals are coherent with no contradictions - the PR:L privilege requirement meaningfully narrows the realistic attacker population to parties who can already authenticate to the RDP service, which lowers real-world priority relative to the 7.1 base score for internet-exposed-but-authenticated servers. Treat this as a patch-in-normal-cycle item unless the FreeRDP server accepts untrusted or low-trust authenticated sessions (e.g. gateway/multi-tenant deployments), where it rises in priority. Note the authentication qualifier is confirmed from the CVSS PR:L metric, not merely inferred from text.

An attacker who can authenticate to a FreeRDP-based server (version 2.0.0 up to but not including 3.32.0) opens a dynamic virtual channel and sends a single seven-byte DATA_FIRST message declaring a very large 32-bit length. The server pre-commits a correspondingly large zeroed memory buffer, and repeating this exhausts server memory and resources, denying service to legitimate users. No public exploit code is identified at time of analysis, and the attack requires valid authentication plus an opened DVC.