Live › vulnerability › CVE-2026-111880
Go to dashboardFreeRDP's server-side NTLM hash-callback path does not validate the MIC offset in AUTHENTICATE_MESSAGE, so a crafted message makes it write 16 zero bytes past an allocation. An unauthenticated attacker who can reach the RDP server can trigger this heap out-of-bounds write.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running FreeRDP in server mode, since the flaw is in the server hash-callback NTLM path; client-only installs are not described as exposed. Teams that only use FreeRDP as a client or run no FreeRDP server can skip it. Exposure depends on whether the RDP listener is reachable from untrusted networks.
No product ranges from the sources yet.
xfreerdp /version or check the installed FreeRDP package version on hosts running a FreeRDP server3.32.0; versions from 2.0.0 up to but not including 3.32.0 are affected3.32.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
This page as .md · .json · in your agent: get_signal("CVE-2026-111880")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.