FreeRDP: Pre-auth memory exhaustion in NLA frame parser
Summary
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption flaw (CWE-400) in the NLA frame parser. An unauthenticated attacker who can reach an NLA-enabled RDP server can complete the TLS handshake and stream bytes with an invalid first byte, so the receive buffer grows without limit before authentication. This can exhaust server memory and cause a denial of service, and no credentials are needed.
Affected
- FreeRDP 3.0.0 up to but not including 3.32.0
Fixed in
- FreeRDP 3.32.0 (per CNA record and vendor release notes)
- FreeRDP 3.32.1 or later recommended (regression and bugfix release)
- Ubuntu 24.04 and 26.04: freerdp3 3.32.0+dfsg-0ubuntu0.24.04.1 and 3.32.0+dfsg-0ubuntu0.26.04.1
- Other distributions: check your vendor tracker for the fixed build
Workaround
Unknown. No vendor workaround was found.
- Restrict RDP access to trusted networks, for example via VPN or source IP filtering.
- Do not expose RDP servers directly to the internet.
Exploitation
- Proof of concept: the advisory includes a PoC, and CISA SSVC lists exploitation as poc.
- Automatable: yes (CISA SSVC).
- Exploitation in the wild: unknown. One aggregator lists it as not in CISA KEV.
Our recommendation
- Inventory all systems running FreeRDP server components, including appliances and embedded devices.
- Update to FreeRDP 3.32.1 or later, or install the fixed distribution package.
- Until patched, block direct internet access to RDP services.
- Monitor RDP hosts for many unauthenticated connections or rising memory use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qpfh-m9w6-xf2x github.com
- VulnCheck Advisory: FreeRDP NLA frame parser memory exhaustion www.vulncheck.com
- FreeRDP 3.32.0 release notes www.freerdp.com
- Ubuntu Security Notice CVE-2026-111378 ubuntu.com
- VulDB CVE-2026-111378 vuldb.com
- Vulners CVE-2026-111378 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:24.
Original description (NVD)
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.