Live › vulnerability › CVE-2026-111377
Go to dashboardFreeRDP's WTSProcessChannelData keeps buffering static virtual channel fragments without a cumulative limit when the final fragment flag is withheld. An authenticated client can send endless fragments and exhaust the server's memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running FreeRDP 2.0.0 through versions before 3.32.0 as an RDP server that accepts static virtual channel traffic from clients. Exposure depends on whether the server build processes these channels through WTSProcessChannelData. Deployments that only use FreeRDP as a client, or that run a patched version, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| freerdp | vendor | >= 2.0.0, < 3.32.0 | 3.32.0 |
xfreerdp --version or check the installed FreeRDP package version on servers that run FreeRDP-based RDP services3.32.03.32.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-111377")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.