CVE-2026-111377 FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

CVE-2026-111377

FreeRDP versions 2.0.0 before 3.32.0 are vulnerable to a memory exhaustion issue in the WTSProcessChannelData function. The root cause is an unbounded reassembly vulnerability where the software fails to enforce limits on cumulative fragments. An authenticated client can exploit this by initiatin...

Red Hat: CVE-2026-111377: freerdp: FreeRDP: Denial of Service via unbounded static channel reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

EUVD-2026-78805

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

Apache Guacamole Information Disclosure Vulnerability (CNVD-2020-41807)

Apache Guacamole is a clientless remote desktop gateway from the American Apache Apache Software Foundation. The product supports protocols such as VNC, RDP and SSH. A security vulnerability exists in Apache Guacamole 1.1.0 and earlier versions, which stems from the program not properly validatin...

PT-2020-5908 · Apache · Apache Guacamole

Name of the Vulnerable Software and Affected Versions: Apache Guacamole versions 1.1.0 and older Description: The issue is related to the mishandling of pointers involved in processing data received via RDP static virtual channels. If a user connects to a malicious or compromised RDP server, a...