PT-2026-115383

CVE-2026-111377

Published

2026-10-16

Updated

2026-10-24

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0

Description An unbounded reassembly issue exists in the WTSProcessChannelData() function. The system fails to enforce cumulative fragment limits, allowing authenticated clients to initiate a static virtual channel message and withhold the LAST flag. This enables the transmission of endless fragments, which can lead to server memory exhaustion.

Recommendations Update FreeRDP to version 3.32.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products