---
id: "CVE-2026-111378"
kind: "vulnerability"
aliases: ["CVE-2026-111378"]
title: "FreeRDP: unauthenticated clients can exhaust server memory before login"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "freerdp", "fixed": ["3.32.0"], "affected": ">= 3.0.0, < 3.32.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["freerdp", "package", "rdp-servers", "self-hosted"]
not_affected_if: ["client-only-use", "no-rdp-server-running"]
published_at: "2026-10-16T03:18:04+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T22:39:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111378", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# FreeRDP: unauthenticated clients can exhaust server memory before login

FreeRDP's server-side NLA handling lets an unauthenticated client finish TLS and then stream bytes that are not a DER SEQUENCE, so the receive buffer grows without bound. An attacker can exhaust the server's memory and crash or stall it without any credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:freerdp affected >= 3.0.0, < 3.32.0 fixed 3.32.0

## How to check

Find FreeRDP server builds or packages on your hosts and check the version: freerdp-shadow-cli /version or the package manager's version query. Versions 3.0.0 up to but not including 3.32.0 are affected.

## Fix

Upgrade FreeRDP to 3.32.0 or later.
Until patched, restrict RDP server port exposure to trusted networks.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111378

## From the sources

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_