CVE-2026-111880

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0

Description A heap out-of-bounds write exists in the server hash-callback NTLM path due to a failure to validate the MIC offset. An unauthenticated attacker can exploit this by sending a crafted AUTHENTICATE MESSAGE containing a backward session-key offset and MIC offset, allowing the write of 16 zero bytes beyond the allocated memory buffer.

Recommendations Update FreeRDP to version 3.32.0 or later.