EUVD-2026-102558
GHSA-5qxm-7xrj-fjrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as RDP client
-
DeliveryOpen static virtual channel
-
ExploitSend fragment without LAST flag
-
ExecutionStream endless fragments
-
ImpactExhaust server memory (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated RDP session against a FreeRDP server built from the vulnerable server-side code path (WTSProcessChannelData handling static virtual channels), versions 2.0.0 up to but not including 3.32.0. The specific trigger is opening a static virtual channel message and continuously sending channel-data fragments while withholding the CHANNEL_FLAG_LAST flag so reassembly never completes. Limiting factors: the attacker must first authenticate (PR:L - this is not pre-auth), and the deployment must expose FreeRDP's server/listener role rather than only the far more common client role, which meaningfully narrows the exposed population. Impact is confined to availability (memory exhaustion / service crash); there is no confidentiality or integrity effect. |
| Impact | This is a legitimate but bounded risk best characterized as a moderate-severity denial-of-service issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, base 7.1) is internally consistent with the description: network-reachable, low attack complexity, requires low-level authentication (PR:L - an authenticated RDP client), no user interaction, and pure availability impact with no confidentiality or integrity loss. The signals do not conflict with each other, but several key prioritization inputs are simply absent: there is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The combination of a CWE-400 resource-exhaustion class, availability-only impact, and the authentication requirement means this is not a drive-by, pre-auth internet worm candidate - it is a post-authentication DoS where an authorized or compromised client can crash/exhaust a FreeRDP-based server. Net: a real but not urgent priority; patch in normal cadence, prioritize higher if you run multi-tenant or internet-exposed FreeRDP server deployments where a single authenticated session crashing the service affects other users. |
| Exploit ScenarioDerived | An authenticated RDP client connects to a FreeRDP-based server and opens a static virtual channel, then begins sending channel-data fragments while deliberately never setting the CHANNEL_FLAG_LAST flag. Because WTSProcessChannelData enforces no cumulative reassembly limit, the server keeps buffering fragments indefinitely until memory is exhausted and the service degrades or crashes. No public proof-of-concept is identified in the provided data, but the technique is simple and requires only a valid authenticated session and low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Memory exhaustion in FreeRDP 2.0.0 through 3.31.x lets an authenticated RDP client degrade or crash a server that exposes FreeRDP's listener role: the attacker opens a static virtual channel message and then streams endless channel-data fragments while withholding the CHANNEL_FLAG_LAST terminator, so the server-side reassembly buffer grows without bound. The issue is scored 7.1 under CVSS 4.0 and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning availability-only impact with no confidentiality or integrity loss. Exploitation is not confirmed in the wild (no CISA KEV listing) and no public exploit identified at time of analysis; the practical exposure is narrowed because the vulnerable code path is server-side and the attacker must already hold an authenticated RDP session.
RemediationAI
Upgrade to FreeRDP 3.32.0 or later; that is the vendor-released patch that adds enforcement of cumulative fragment limits in WTSProcessChannelData, and it is the only complete fix. Until the upgrade can be scheduled, the most effective compensating control is to bound the damage rather than the trigger: run the FreeRDP server under a cgroup or systemd unit memory limit (for example MemoryMax) so exhaustion terminates only that service instead of pressuring the host - the trade-off is that a successful attack still restarts or kills the RDP service, and legitimate large channel transfers may be truncated if the limit is set too low. Because exploitation requires an authenticated session, restricting who can log in to the FreeRDP listener (dedicated low-privilege accounts, no shared credentials) materially reduces the attacker pool, and firewall rules limiting TCP 3389 to trusted management networks remove remote reachability entirely at the cost of legitimate remote access. If static virtual channel functionality is not required by the deployment, disabling or refusing unnecessary channels reduces the attack surface, though this breaks applications that rely on them. Monitor for long-lived, never-terminating channel reassembly buffers or unexplained memory growth in the server process as a detection signal, and consult GHSA-xm53-352c-57jw and https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-memory-exhaustion-via-static-channel-reassembly for the latest vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) used both as a client and, in some deployments, as a server/listener. The affected code is WTSProcessChannelData, the routine that reassembles incoming data for static virtual channels. RDP fragments channel payloads across multiple PDUs, marking the first fragment with CHANNEL_FLAG_FIRST and the final fragment with CHANNEL_FLAG_LAST; the reassembly logic is expected to cap the cumulative size of a single logical message and to time out or reject a message that never completes. CVE-2026-111377 is rooted in CWE-400 (Uncontrolled Resource Consumption) because that cumulative limit is not enforced: an authenticated peer can begin a message, never set CHANNEL_FLAG_LAST, and keep appending fragments indefinitely, causing unbounded heap growth on the server. The CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* is a wildcard entry, so the precise affected range comes from the vendor advisory rather than the CPE itself: all releases from 2.0.0 up to but not including 3.32.0. Only installations running the server-side static-virtual-channel handling path are exposed; the far more common FreeRDP client role does not process attacker-supplied fragments in this way.
Know when Freerdp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable channel data with low complexity, but requires an authenticated client session (PR:L) and causes only availability loss via memory exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption) in FreeRDP's server-side static virtual channel reassembly.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A memory-exhaustion flaw in FreeRDP (versions 2.0.0 through 3.31.x) can let an already-authenticated RDP client drive a server running FreeRDP's listener role into resource exhaustion, degrading or crashing the service and disrupting RDP-dependent operations. Because the vulnerable code path is server-side and requires a valid RDP session, exposure is limited to environments where authenticated or untrusted users can reach a FreeRDP listener, but any such outage could interrupt remote access for the teams and services that depend on it. No vendor patch is currently available, so risk must be managed through exposure reduction and monitoring until remediation ships.
No vendor patch available. Interim mitigations: restrict FreeRDP listener exposure to trusted network segments, limit and audit who can establish authenticated RDP sessions, enforce least privilege and session timeouts on RDP accounts, disable unused static virtual channels where configuration permits, apply process memory limits (cgroups/systemd MemoryMax), enable watchdog auto-restart to contain exhaustion events, and monitor for abnormal memory growth or unbounded virtual channel sessions. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in FreeRDP Memory Safety and Resource Exhaustion Flaws
View all 10Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and
FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
Exploit-DB