FreeRDP CVE-2026-111378

Target must be running the FreeRDP server-side component (versions 3.0.0 through 3.31.x) with TLS enabled and reachable on its listening port. Exploitation occurs BEFORE NLA authentication, so no credentials, no user interaction, and no non-default feature flag are required - the attacker only needs to complete the TLS handshake and then send bytes whose first byte is not the DER SEQUENCE tag 0x30, causing parse_nla_mode_pdu to grow the receive buffer without bound. Limiting factors: exploitation requires network reachability of a FreeRDP-based *server* (the far more common client role is not the attack surface here), and the affected version window (3.0.0 to <3.32.0); impact is limited to availability (no code execution, no data disclosure).

This is a genuine, easy-to-trigger denial-of-service issue but not a confidence-and-integrity threat. The only CVSS vector supplied is CVSS 4.0 (8.7/High): AV:N/AC:L/AT:N/PR:N/UI:N with impact isolated to availability of the vulnerable system (VA:H) and VC:N/VI:N - consistent with CWE-400 uncontrolled resource consumption and with a description of unauthenticated memory exhaustion. The pre-authentication, network, low-complexity, no-interaction profile means it is trivially reachable, which is why the score is high. However, no CVSS 3.1 vector, EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input. Accordingly: no public exploit identified at time of analysis, and this is NOT confirmed actively exploited (not in CISA KEV). The realistic priority is moderate - patch promptly on internet-exposed FreeRDP-based servers because exploitation is cheap and pre-auth, but there is no code execution or data exposure, and absent EPSS/KEV data there is no evidence of widespread or targeted exploitation. Treat the high CVSS as a reachability signal, not as proof of imminent mass exploitation.

An unauthenticated attacker reaches a FreeRDP-based server (version 3.0.0 up to but not including 3.32.0), completes the TLS handshake, and then streams a continuous flow of bytes that do not begin with the DER SEQUENCE tag (0x30). Because parse_nla_mode_pdu never bounds the receive buffer before NLA authentication, the buffer grows without limit until the server exhausts memory and the service (or host) fails. No public exploit is identified, but the technique requires only a TLS client and a raw byte stream.