HIGH 7.1 NVD
CVE-2026-111377
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authe
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xm53-352c-57jw
- https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-memory-exhaustion-via-sta
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-16 via NVD.
vulnfeed aggregates 14608 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.