PT-2026-116452

CVE-2026-111880

Published

2026-10-17

Updated

2026-11-03

Description by

CVSS 4.0

8.3

High

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0

Description A heap out-of-bounds write exists in the server hash-callback NTLM path due to a failure to validate the MIC offset. An unauthenticated attacker can exploit this by sending a crafted AUTHENTICATE MESSAGE containing a backward session-key offset and MIC offset, allowing the write of 16 zero bytes beyond the allocated memory buffer.

Recommendations Update FreeRDP to version 3.32.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products