CVE-2026-111880 in FreeRDP
Summary
by MITRE • 10/17/2026
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in FreeRDP versions ranging from 2.0.0 up to, but not including, version 3.32.0 represents a critical heap-based buffer overflow within the Remote Desktop Protocol implementation. Specifically, this flaw resides in the server-side hash-callback mechanism associated with NTLM authentication. The core technical deficiency is a failure to properly validate input parameters related to session key offsets and Message Integrity Code (MIC) offsets during the processing of an AUTHENTICATE_MESSAGE. When an attacker constructs a maliciously crafted packet containing backward or invalid offset values, the application fails to perform necessary bounds checking before attempting to write data into memory buffers allocated for handling these cryptographic structures.
During normal operation, FreeRDP processes authentication messages from clients seeking to establish a secure session. The NTLM hash-callback function is responsible for verifying the integrity and authenticity of the connection by processing MICs derived from session keys. However, due to the missing validation logic, if an unauthenticated attacker sends a specially crafted AUTHENTICATE_MESSAGE with manipulated offset fields pointing backwards relative to the current buffer position, the internal pointer arithmetic calculates an incorrect memory address. This miscalculation results in writing sixteen zero bytes beyond the boundaries of the allocated heap region. While the immediate action is a write operation rather than a read, overwriting adjacent heap metadata or data structures can lead to severe instability and potential exploitation vectors such as arbitrary code execution if the attacker can control subsequent allocations or trigger specific memory management behaviors following the corruption.
The operational impact of this vulnerability is significant because it allows unauthenticated remote attackers to cause a denial of service by crashing the FreeRDP server process through heap corruption, which may also serve as an initial foothold for more advanced exploitation techniques depending on the environment and compiler protections in place. Heap out-of-bounds writes are particularly dangerous as they can corrupt internal data structures used by memory allocators like ptmalloc or jemalloc, potentially leading to control flow hijacking if the attacker can predict heap layout and manipulate subsequent allocation requests. This aligns with Common Weakness Enumeration (CWE) category CWE-787: Out-of-bounds Write, which describes writing data outside of intended boundaries, often resulting in application crashes or arbitrary code execution. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, this vulnerability facilitates initial access and potentially privilege escalation through exploitation techniques categorized under T1203: Exploitation for Client Execution, as it targets client-facing services that handle untrusted input without proper validation.
To mitigate this risk, organizations utilizing FreeRDP must immediately upgrade to version 3.32.0 or later where the offset validation logic has been corrected to ensure all memory accesses remain within allocated bounds. For environments unable to patch immediately, deploying network-level authentication (NLA) restrictions and restricting access to RDP services via firewalls can reduce exposure by limiting who can send AUTHENTICATE_MESSAGE packets. Additionally, enabling heap protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on the server infrastructure can help mitigate the likelihood of successful code execution resulting from this memory corruption flaw. Regular security audits focusing on input validation in cryptographic callback functions are recommended to prevent similar issues in other components of the remote desktop stack.