Live › vulnerability › CVE-2026-111378
Go to dashboardFreeRDP's server-side NLA handling lets an unauthenticated client finish TLS and then stream bytes that are not a DER SEQUENCE, so the receive buffer grows without bound. An attacker can exhaust the server's memory and crash or stall it without any credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| freerdp | vendor | >= 3.0.0, < 3.32.0 | 3.32.0 |
3.0.0 up to but not including 3.32.0 are affected3.32.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-111378")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.