FreeRDP CVE-2026-110833

Exploitation requires the target to be running FreeRDP in PROXY mode (the pf/proxy component) with the RDPDR device-redirection channel reachable by the attacker - plain FreeRDP client or server deployments are not the stated target. The attacker sends a FIRST RDPDR fragment followed by continuation fragments that never carry the LAST flag, and must SUSTAIN this traffic because memory growth is proportional to bytes sent (reflected in AC:H/AT:P); a single packet does not trigger the condition. No authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors: only affected versions 3.0.0-beta1 through before 3.32.0 are vulnerable, the proxy must be exposed to untrusted clients, and the gradual exhaustion depends on the attacker maintaining the fragment stream long enough to outpace available memory.

This is a memory-exhaustion denial-of-service (CWE-400) in the FreeRDP proxy, rated CVSS 4.0 8.2 (High). The vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N with VC:N/VI:N/VA:H confirms a network-reachable, unauthenticated (PR:N) attack that affects availability ONLY - there is no confidentiality or integrity impact, so this cannot lead to code execution or data theft. The elevated AC:H and AT:P (attack requirements present) are meaningful: the attacker must sustain a stream of RDPDR continuation fragments and the impact grows proportional to traffic, so exhaustion is gradual rather than a single-packet crash. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this is 'no public exploit identified at time of analysis.' Net assessment: a credible availability risk for anyone running FreeRDP in proxy mode exposed to untrusted clients, but it is a resource-exhaustion DoS rather than a critical RCE; the raw 8.2 overstates urgency relative to the single-dimension (availability-only) impact. Note the tension between AV:N/PR:N (sounds trivially remote) and AC:H/AT:P plus the gradual proportional-growth mechanism, which together imply exploitation requires sustained effort against a specifically-deployed proxy rather than a one-shot remote kill.

An attacker who can reach a FreeRDP proxy opens a session and sends a FIRST RDPDR channel fragment followed by an unbounded stream of continuation fragments that never include a LAST marker. Because no cumulative or absolute size limit is enforced during reassembly, the per-session heap stream grows in proportion to the traffic sent, eventually exhausting proxy memory and denying service to legitimate users. No public exploit code was identified; the attack is unauthenticated (PR:N) but requires sustained traffic (AC:H/AT:P) rather than a single crafted packet.