medium6.5
CVE-2026-111377
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits.
Impact
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freerdp | Freerdp | from 2.0.0 before 3.32.0 |