CVE-2026-111378

7.5High

Published 16 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400

Impact

Unauthenticated remote attackers can crash the server by exhausting memory before NLA authentication finishes. They only need network access to establish a TLS connection to the FreeRDP service.

Root cause

The parse_nla_mode_pdu function allows unbounded receive buffer growth when receiving streamed bytes that do not start with the expected DER SEQUENCE tag (0x30).

Affected systems

FreeRDP 3.0.0 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. If upgrading immediately is not possible, restrict network access to the RDP port (typically TCP 3389) using firewall rules to trusted IPs only.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp2-x11 libfreerdp3

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111378