VYPR
Published Oct 17, 2026· 1 source

FreeRDP: 25 Vulnerabilities Disclosed, Ranging from Memory Corruption to Credential Issues

Key findings • A batch of 25 vulnerabilities affecting FreeRDP was disclosed between October 13-17, 2026. • High severity flaws include memory corruption in BMP and JPEG processing, and NTLM …

Key findings

  • A batch of 25 vulnerabilities affecting FreeRDP was disclosed between October 13-17, 2026.
  • High severity flaws include memory corruption in BMP and JPEG processing, and NTLM authentication.
  • Multiple vulnerabilities related to resource exhaustion and denial-of-service conditions were found.
  • Credential delegation and security protocol downgrade issues were also part of the disclosure.
  • All disclosed vulnerabilities are fixed in FreeRDP version 3.32.0.

On October 13-17, 2026, a significant batch of 25 vulnerabilities was disclosed for FreeRDP, a widely used open-source Remote Desktop Protocol client and server. The vulnerabilities, spanning a range of severities from Medium to High, primarily involve memory corruption, resource exhaustion, and credential handling issues. The disclosure highlights potential risks for users relying on FreeRDP for remote access and system administration.

Several vulnerabilities stem from improper handling of image data and audio processing. CVE-2026-111881, a High severity integer underflow in the WinPR BMP writer, could allow a malicious RDP clipboard peer to corrupt client memory. Similarly, CVE-2026-111382, another High severity heap out-of-bounds write, affects general Luma to YUV color space conversions, potentially allowing malicious RDP servers to corrupt client memory. CVE-2026-111380 details an integer overflow in the Apple audio backends, bypassing a previous fix and allowing for potential memory corruption. CVE-2026-110830 describes a heap-based buffer overflow in MP3 decoding when specific build configurations are used, which could lead to heap corruption. CVE-2026-110839 points to a heap-based out-of-bounds write in JPEG conversion when handling grayscale images.

Memory corruption vulnerabilities are a recurring theme, with multiple instances of heap overflows and out-of-bounds writes. CVE-2026-111880, a High severity heap out-of-bounds write, occurs in the server hash-callback NTLM path due to a failure to validate the MIC offset. CVE-2026-111381 and CVE-2026-111379 describe heap buffer overflows in the persistent cache reading functions, exploitable via integer wraparound or crafted cache files, respectively. CVE-2026-111376 details an infinite loop in HTTP response handling that could lead to CPU exhaustion.

Resource exhaustion vulnerabilities are also present, posing denial-of-service risks. CVE-2026-111378, a High severity uncontrolled resource consumption flaw in parse_nla_mode_pdu, allows unauthenticated attackers to exhaust server memory by sending malformed TLS data. CVE-2026-111377 describes an unbounded reassembly vulnerability in WTSProcessChannelData, where authenticated clients can exhaust server memory by sending fragmented channel messages without the LAST flag. CVE-2026-111373 notes a NULL pointer dereference in the websocket transport that can crash clients via zero-length pings. CVE-2026-110833 details a similar issue in the proxy's RDPDR channel fragment reassembly, leading to memory exhaustion. CVE-2026-110832 allows authenticated clients to force large memory allocations on servers. CVE-2026-110830 describes how repeated serial IRP_MJ_CREATE requests can exhaust file descriptors, leading to client termination. CVE-2026-110829 details a NULL pointer dereference in the rdpsnd channel that can crash the client.

Credential and protocol security issues were also disclosed. CVE-2026-109953, a Medium severity vulnerability, indicates that the /restricted-admin option fails to suppress CredSSP credential delegation, potentially exposing cleartext passwords. CVE-2026-109952, another Medium severity flaw, allows for security protocol downgrades, enabling a malicious server or man-in-the-middle to force a less secure protocol.

The entire batch of vulnerabilities is addressed in FreeRDP version 3.32.0. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The broad nature of these vulnerabilities underscores the importance of regular updates and security audits for systems utilizing FreeRDP.

The disclosure, spanning multiple days, indicates a coordinated effort to address a wide range of issues within the FreeRDP codebase. The prevalence of memory corruption and resource exhaustion vulnerabilities highlights the ongoing challenges in securely handling complex network protocols and data parsing.

Key Findings:

  • A batch of 25 vulnerabilities affecting FreeRDP was disclosed between October 13-17, 2026.
  • High severity flaws include memory corruption in BMP and JPEG processing, and NTLM authentication.
  • Multiple vulnerabilities related to resource exhaustion and denial-of-service conditions were found.
  • Credential delegation and security protocol downgrade issues were also part of the disclosure.
  • All disclosed vulnerabilities are fixed in FreeRDP version 3.32.0.
  • Vulnerabilities impact various components including clipboard handling, audio processing, and network transports.
  • Exploitation could lead to memory corruption, denial of service, and potential credential compromise.
  • Users are urged to update to FreeRDP version 3.32.0 to patch these issues.

CVE IDs: CVE-2026-111881, CVE-2026-111880, CVE-2026-111382, CVE-2026-111381, CVE-2026-111380, CVE-2026-111379, CVE-2026-111378, CVE-2026-111377, CVE-2026-111376, CVE-2026-111375, CVE-2026-111374, CVE-2026-111373, CVE-2026-110839, CVE-2026-110838, CVE-2026-110837, CVE-2026-110836, CVE-2026-110835, CVE-2026-110834, CVE-2026-110833, CVE-2026-110832, CVE-2026-110831, CVE-2026-110830, CVE-2026-110829, CVE-2026-109953, CVE-2026-109952

Synthesized by Vypr AI