FreeRDP CVE-2026-111880

The affected system must be running FreeRDP acting as an RDP SERVER and using the NTLM authentication hash-callback code path - this is not triggerable against FreeRDP client-only deployments. Exploitation requires sending a specially crafted NTLM AUTHENTICATE_MESSAGE whose session-key offset and MIC offset point backward, which the server fails to validate before writing. Per the vector, no authentication (PR:N) and no user interaction (UI:N) are needed, but AC:H plus AT:P indicate the attack depends on specific conditions (e.g., reachable server NTLM path and favorable heap state), which limits reliable widespread exploitation. The write primitive is fixed (16 zero bytes beyond the allocation), constraining - though not necessarily eliminating - escalation beyond crash/DoS.

This is a genuine but conditional priority, not an inflated high-CVSS issue. The CVSS 4.0 vector (AV:N/PR:N/UI:N) confirms a remotely reachable, unauthenticated, no-interaction flaw - all attractive properties - but AC:H combined with AT:P signals meaningful attack complexity and a specific attack requirement, which materially lowers the odds of trivial, reliable mass exploitation. The impact profile (VC:N/VI:H/VA:H) correctly reflects a heap out-of-bounds write of 16 zero bytes: no confidentiality loss, but corruption (integrity) and likely crash/denial-of-service (availability); CWE-787 means potential for code execution cannot be fully excluded, though writing fixed zero bytes at a backward-controlled offset is a constrained primitive. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - exploitation status rests on vendor/researcher disclosure (VulnCheck + FreeRDP GHSA advisory) only. Net: patch promptly where FreeRDP is exposed in server mode, but the AC:H/AT:P conditions suggest targeted or skilled exploitation rather than opportunistic worming. Note the only scoring signal provided is a CVSS 4.0 vector; no CVSS 3.1 vector, EPSS, or exploitation-maturity data was supplied to cross-check against.

An attacker who can reach a FreeRDP-based RDP server that uses the NTLM hash-callback authentication path sends a crafted AUTHENTICATE_MESSAGE containing a backward session-key offset and MIC offset. Because the MIC offset is not validated, the server writes 16 zero bytes past the heap allocation, corrupting adjacent heap data and typically crashing the service (DoS), with a bounded possibility of further memory-corruption exploitation. No public exploit code was identified in the provided data, and the AC:H/AT:P metrics indicate reliable exploitation requires specific heap or protocol-state conditions.