High priorityDisclosed

Advisory · CVE-2026-111880

FreeRDP NTLM hash callback can write beyond its buffer from a crafted message

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path, which does not validate the MIC offset in a crafted AUTHENTICATE_MESSAGE. CVSS 4.0 8.3 (CVSS 3.1 7.4).

Advisory published October 17, 2026Independent summary
Vendor
FreeRDP
Product
FreeRDP
Identifier / CWE
CVE-2026-111880
CWE-787
Action timing
Immediate
ELI5

Explain it like I’m five

A remote login message tells FreeRDP where in a buffer to write, and FreeRDP does not check that the spot is inside the buffer before writing.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Crafted login message

    An unauthenticated attacker sends a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and a MIC offset.

  2. 02Offset not validated

    The server hash-callback NTLM path uses the MIC offset without validating it against the allocation.

  3. 03Out-of-bounds write

    Sixteen zero bytes are written beyond the allocation, corrupting heap memory.

What happened

The FreeRDP project disclosed CVE-2026-111880: a heap out-of-bounds write (CWE-787) in the server hash-callback NTLM path, which fails to validate the MIC offset. It affects versions from 2.0.0 before 3.32.0, and unauthenticated attackers can trigger it with a crafted AUTHENTICATE_MESSAGE.

Per the vendor affected data in the NVD record, 3.32.0 is the first unaffected release, so upgrading to 3.32.0 or later is the stated fix.

What to do

  1. Inventory FreeRDP servers and gateways, including packages bundled by distributions and appliances.
  2. Upgrade affected installs to 3.32.0 or later using the project release guidance.
  3. Restrict network access to RDP services to trusted sources while remediation is underway.
  4. Hunt for FreeRDP server crashes and malformed NTLM authentication attempts in connection logs.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

RDP sits on the perimeter by design, and this flaw is reachable before authentication. Put FreeRDP servers on the urgent patch ring and keep them behind a gateway wherever you can.