CVE-2026-111378 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified vulnerability resides within the FreeRDP implementation, specifically affecting versions ranging from 3.0.0 up to but excluding 3.32.0. This flaw is classified as an uncontrolled resource consumption issue located in the parse_nla_mode_pdu function, which handles Network Level Authentication mode protocol data units. The core technical deficiency involves a failure to properly validate or bound the size of incoming network streams before processing them for NLA authentication. Specifically, the parser does not enforce strict constraints on stream bytes that do not begin with the DER SEQUENCE tag 0x30, which is a standard marker in ASN.1 encoding used by many security protocols including TLS and NTLM. This lack of validation allows an unauthenticated attacker to craft maliciously formatted packets containing arbitrary amounts of data that bypass initial structural checks.
During the operational lifecycle of a FreeRDP server connection, the client must first establish a secure channel via Transport Layer Security before proceeding with NLA authentication. The vulnerability exploits this sequence by allowing attackers to send TLS and stream bytes that lack the expected 0x30 prefix. Because the parser fails to reject or limit these malformed inputs, it proceeds to process them without verifying their length or structure against predefined limits. This results in unbounded growth of the receive buffer as the server attempts to accommodate the excessive data provided by the attacker. The memory allocation for this buffer is not capped at a safe threshold relative to available system resources, leading directly to resource exhaustion on the target host.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service condition through memory exhaustion. As the server continues to allocate memory for these uncontrolled buffers, it eventually depletes its available RAM or swap space. This can cause the FreeRDP process to crash due to out-of-memory errors, leading to immediate disruption of remote desktop services for legitimate users. In more complex deployments where multiple connections are handled concurrently by a single server instance, this vulnerability could potentially destabilize the entire service if an attacker targets high-traffic endpoints or exploits the flaw across many simultaneous sessions. The lack of authentication requirement makes this particularly dangerous as it can be exploited remotely without prior credentials, significantly lowering the barrier for entry for malicious actors seeking to disrupt availability.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption within software systems. It also maps to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via resource exhaustion methods such as memory leaks or allocation failures. The attack vector is network-based and requires no user interaction beyond initiating a connection attempt with the crafted payload. To mitigate this risk, organizations running FreeRDP servers must immediately upgrade to version 3.32.0 or later where these bounds checking mechanisms have been implemented in the parse_nla_mode_pdu function. Additionally, deploying network-level intrusion detection systems that can identify anomalous stream sizes during the TLS handshake phase may provide an additional layer of defense against exploitation attempts before they reach the vulnerable application logic. Regular patch management and monitoring for unusual memory usage patterns on RDP hosts are critical components of a comprehensive security posture against this specific threat vector.