{"id":"CVE-2026-111378","kind":"vulnerability","aliases":["CVE-2026-111378"],"related":[],"title":"FreeRDP: unauthenticated clients can exhaust server memory before login","description":"FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.","summary":"FreeRDP's server-side NLA handling lets an unauthenticated client finish TLS and then stream bytes that are not a DER SEQUENCE, so the receive buffer grows without bound. An attacker can exhaust the server's memory and crash or stall it without any credentials.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"freerdp","fixed":["3.32.0"],"affected":">= 3.0.0, < 3.32.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["freerdp","package","rdp-servers","self-hosted"],"not_affected_if":["client-only-use","no-rdp-server-running"],"how_to_check":"Find FreeRDP server builds or packages on your hosts and check the version: freerdp-shadow-cli /version or the package manager's version query. Versions 3.0.0 up to but not including 3.32.0 are affected.","fix":"Upgrade FreeRDP to 3.32.0 or later.\nUntil patched, restrict RDP server port exposure to trusted networks.","status":"open","published_at":"2026-10-16T03:18:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:39:09+00:00","updated_at":"2026-10-23T22:39:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:09Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade FreeRDP to 3.32.0 or later.\nUntil patched, restrict RDP server port exposure to trusted networks.","reach":"network","title":"FreeRDP: unauthenticated clients can exhaust server memory before login","impact":"medium","summary":"FreeRDP's server-side NLA handling lets an unauthenticated client finish TLS and then stream bytes that are not a DER SEQUENCE, so the receive buffer grows without bound. An attacker can exhaust the server's memory and crash or stall it without any credentials.","category":"package","who_cares":["freerdp","self-hosted","rdp-servers"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated remote attacker exhausts server memory, causing denial of service.","analyst_note":"Confirm whether the NVD entry's affected range and fixed version 3.32.0 match the upstream FreeRDP advisory and whether the default config runs the NLA server path.","how_to_check":"Find FreeRDP server builds or packages on your hosts and check the version: freerdp-shadow-cli /version or the package manager's version query. Versions 3.0.0 up to but not including 3.32.0 are affected.","needs_analyst":true,"not_affected_if":["client-only-use","no-rdp-server-running"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000546,"input_tokens":2997,"output_tokens":492,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111378':12A,15A '-2026':11A,14A '0x30':109C '3.0.0':73C '3.32.0':75C 'allow':88C 'attack':56B,90C,95C 'authent':117C 'begin':103C 'bound':54B 'buffer':51B,113C 'byte':41B,101C 'caus':110C 'client':3A,35B 'complet':97C 'consumpt':80C 'contain':76C 'crash':64B 'credenti':70B 'cve':10A,13A 'der':46B,106C 'exhaust':5A,58B,92C 'finish':36B 'freerdp':1A,16A,17B,25B,71C 'grow':52B 'growth':114C 'handl':31B 'host':24B 'let':32B 'login':9A 'memori':7A,62B,94C 'mode':85C 'nla':30B,84C,116C 'packag':18B 'pars':83C 'pdu':86C 'rdp':20B 'rdp-server':19B 'receiv':50B,112C 'resourc':79C 'self':23B 'self-host':22B 'sequenc':47B,107C 'server':6A,21B,28B,60B,93C 'server-sid':27B 'side':29B 'stall':66B 'stream':40B,100C 'tag':108C 'tls':37B,98C 'unauthent':2A,34B,89C 'unbound':111C 'uncontrol':78C 'vulner':81C 'without':53B,68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111378","severity":null,"published_at":"2026-10-16T03:18:04+00:00","modified_at":"2026-10-20T15:34:51+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}