CVE-2026-111377

FreeRDP versions 2.0.0 before 3.32.0 are vulnerable to a memory exhaustion issue in the WTSProcessChannelData function. The root cause is an unbounded reassembly vulnerability where the software fails to enforce limits on cumulative fragments. An authenticated client can exploit this by initiatin...

EUVD-2026-102558

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...