CVE-2026-110833
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy.
Published Oct 14, 2026 · updated Oct 15, 2026
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
Oct 15, 2026 · OSV.dev
Fix available
freerdp3 fixed in 3.32.0+dfsg-1
Oct 15, 2026 · OSV.dev
Fix available
freerdp3 fixed in 3.32.0+dfsg-1
Oct 15, 2026 · OSV.dev
Updated
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
Oct 15, 2026 · NIST NVD
Updated
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
Affected
- Debian:12 freerdp22.10.0+dfsg1-1, 2.10.0+dfsg1-1.1, 2.11.2+dfsg1-1
- Debian:13 freerdp33.15.0+dfsg-2.1, 3.15.0+dfsg-2.1+deb13u1, 3.15.0+dfsg-2.1+deb13u2
- Debian:14 freerdp30 → 3.32.0+dfsg-1
Sources
- CVE.orgVulnerability recordCVE-2026-110833
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-110833
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-110833
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to
nvd.nist.gov - OSV.devPackage advisoryDEBIAN-CVE-2026-110833osv.dev