Advisory · CVE-2026-111378
Unauthenticated attackers can exhaust FreeRDP server memory through the NLA parser
FreeRDP servers from 3.0.0 before 3.32.0 grow an unbounded receive buffer when a pre-authentication client streams bytes that are not a valid NLA frame. CVSS 4.0 8.7.
- Vendor
- FreeRDP
- Product
- FreeRDP
- Identifier / CWE
- CVE-2026-111378
CWE-400 - Action timing
- Immediate
Explain it like I’m five
The server keeps swallowing bytes from a stranger who has not logged in yet, because it cannot tell a broken frame header from an unfinished one, until memory runs out.
- 01Server exposed
A host runs an NLA-enabled FreeRDP server from an affected release.
- 02TLS completed
An unauthenticated attacker connects and completes the TLS handshake.
- 03Invalid bytes streamed
The attacker streams bytes that do not begin with the DER SEQUENCE tag 0x30.
- 04Buffer keeps growing
The NLA frame parser treats the invalid prefix as an incomplete header, so the transport reader keeps appending to the receive buffer.
- 05Memory exhausted
Sustained or parallel connections consume process memory and connection-handling resources, denying service to legitimate users.
What happened
The GitHub advisory for FreeRDP describes an uncontrolled resource consumption flaw in the NLA frame parser, present from 3.0.0 and fixed in 3.32.0 according to the NVD listing.
An unauthenticated client that completes the TLS handshake can stream bytes beginning with a value other than the DER SEQUENCE tag 0x30. The parser returns the same result for this definitively invalid prefix as for an incomplete valid header, so the transport reader appends one byte and parses again from the unchanged invalid first byte. The receive buffer grows for as long as the peer supplies data.
The attack happens before any RDP credential is accepted. The advisory is explicit that it does not bypass NLA, disclose data, or corrupt memory; the impact is availability, as concurrent unauthenticated connections can consume process memory and connection-handling resources.
What to do
- Inventory FreeRDP servers, including gateways, jump hosts, and shadow or support servers reachable from untrusted networks.
- Upgrade affected servers to FreeRDP 3.32.0 or later using the project release guidance.
- Restrict network access to RDP services to trusted networks while remediation is underway.
- Review connection and process logs for long-lived pre-authentication connections and unexplained memory growth.
- Verify the deployed version and confirm normal NLA sign-in still works after the upgrade.
Management note
This is a cheap, pre-authentication denial of service against a remote access service: no credentials, no user interaction, just bandwidth. Internet-facing FreeRDP servers should be patched first and watched for memory exhaustion patterns until they are.