{"id":"CVE-2026-111377","kind":"vulnerability","aliases":["CVE-2026-111377"],"related":[],"title":"FreeRDP: unbounded fragment reassembly lets clients exhaust server memory","description":"FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.","summary":"FreeRDP's WTSProcessChannelData keeps buffering static virtual channel fragments without a cumulative limit when the final fragment flag is withheld. An authenticated client can send endless fragments and exhaust the server's memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"freerdp","fixed":["3.32.0"],"affected":">= 2.0.0, < 3.32.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["freerdp","package","rdp-server","self-hosted"],"not_affected_if":["client-only","freerdp-3.32.0-or-later"],"how_to_check":"- Run `xfreerdp --version` or check the installed FreeRDP package version on servers that run FreeRDP-based RDP services\n- Check whether the FreeRDP build in use is older than `3.32.0`","fix":"- Upgrade FreeRDP to `3.32.0` or later\n- Restrict RDP server access to trusted clients until patched","status":"open","published_at":"2026-10-16T03:18:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:36:50+00:00","updated_at":"2026-10-25T03:36:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRDP to `3.32.0` or later\n- Restrict RDP server access to trusted clients until patched","reach":"network","title":"FreeRDP: unbounded fragment reassembly lets clients exhaust server memory","impact":"medium","summary":"FreeRDP's WTSProcessChannelData keeps buffering static virtual channel fragments without a cumulative limit when the final fragment flag is withheld. An authenticated client can send endless fragments and exhaust the server's memory.","category":"package","nicknames":[],"who_cares":["freerdp","rdp-server","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server memory is exhausted by an authenticated client, causing denial of service","analyst_note":"Confirm which FreeRDP server components and channel paths reach WTSProcessChannelData and check the NVD entry for the CVSS vector and any upstream advisory.","how_to_check":"- Run `xfreerdp --version` or check the installed FreeRDP package version on servers that run FreeRDP-based RDP services\n- Check whether the FreeRDP build in use is older than `3.32.0`","needs_analyst":true,"not_affected_if":["freerdp-3.32.0-or-later","client-only"],"who_is_affected":"Systems running FreeRDP 2.0.0 through versions before 3.32.0 as an RDP server that accepts static virtual channel traffic from clients. Exposure depends on whether the server build processes these channels through WTSProcessChannelData. Deployments that only use FreeRDP as a client, or that run a patched version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":3377,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111377':12A,15A '-2026':11A,14A '2.0.0':60C '3.32.0':62C 'authent':46B,77C 'buffer':29B 'channel':32B,84C 'client':6A,47B,78C 'contain':63C 'cumul':36B,74C 'cve':10A,13A 'endless':50B,92C 'enforc':73C 'exhaust':7A,53B,95C 'fail':71C 'final':40B 'flag':42B,89C 'fragment':3A,33B,41B,51B,75C,93C 'freerdp':1A,16A,17B,25B,58C 'host':24B 'keep':28B 'last':88C 'let':5A 'limit':37B,76C 'memori':9A,57B,97C 'messag':85C 'packag':18B 'rdp':20B 'rdp-server':19B 'reassembl':4A,66C 'self':23B 'self-host':22B 'send':49B,91C 'server':8A,21B,55B,96C 'start':80C 'static':30B,82C 'unbound':2A,65C 'virtual':31B,83C 'vulner':67C 'withheld':44B 'withhold':86C 'without':34B 'wtsprocesschanneldata':27B,69C","nicknames":[],"mitigations":[],"who_affected":"Systems running FreeRDP 2.0.0 through versions before 3.32.0 as an RDP server that accepts static virtual channel traffic from clients. Exposure depends on whether the server build processes these channels through WTSProcessChannelData. Deployments that only use FreeRDP as a client, or that run a patched version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111377","severity":null,"published_at":"2026-10-16T03:18:04+00:00","modified_at":"2026-10-20T15:34:57+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}