PT-2026-115384

CVE-2026-111378

Published

2026-10-16

Updated

2026-11-03

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0

Description An uncontrolled resource consumption issue exists in the parse nla mode pdu() function. Unauthenticated attackers can exhaust server memory by completing TLS and streaming bytes that do not begin with the DER SEQUENCE tag 0x30. This action causes the receive buffer to grow without bounds before Network Level Authentication (NLA) occurs.

Recommendations Update FreeRDP to version 3.32.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products