Medium severity6.5NVD Advisory· Published Oct 16, 2026

CVE-2026-111377

Description

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

Affected products

Freerdp/Freerdpllm-fuzzy
Range: <3.32.0

Patches

Vulnerability mechanics

References

github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xm53-352c-57jwnvd
www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-memory-exhaustion-via-static-channel-reassemblynvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000