FreeRDP: Unbounded memory retention via RDPDR proxy fragments
Summary
FreeRDP versions from 3.0.0-beta1 before 3.32.0 do not enforce size limits when the proxy reassembles RDPDR channel fragments. An attacker with an established RDP connection can send a FIRST fragment followed by continuation fragments without a LAST fragment, so retained memory grows with the traffic sent. This can exhaust memory of the shared proxy process; the proxy is only affected if it is configured to intercept the RDPDR channel. No code execution, crash or confidentiality or integrity impact was demonstrated.
Affected
- FreeRDP 3.0.0-beta1 to before 3.32.0 (per CNA record)
- Only deployments running freerdp-proxy with RDPDR interception enabled
- Distribution packages: unknown; check your distro tracker
Fixed in
- FreeRDP 3.32.0
- Distribution packages: unknown
Workaround
- No vendor-documented workaround. Upgrading to 3.32.0 is the only remediation named in the sources.
Exploitation
- CISA KEV: not listed.
- EPSS: 0.0025 (very low).
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept found; this does not rule one out.
Our recommendation
- Inventory all FreeRDP builds and proxy deployments, especially internet-facing gateways or jump hosts.
- Upgrade to FreeRDP 3.32.0 or later, or to a distribution package that includes the fix.
- If no freerdp-proxy is deployed, verify with the advisory that you are not affected.
- Monitor the GitHub advisory and VulnCheck page for exploit publication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m7g5-gw57-cwcr github.com
- VulnCheck advisory www.vulncheck.com
- FreeRDP 3.32.0 release github.com
- Ubuntu security tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:13.
Original description (NVD)
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.