---
id: CVE-2026-111378
title: >-
  FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame
  Parser
summary: >-
  FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption
  vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to
  exhaust server memory. Attackers can complete TLS and stream bytes not
  beginning …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-770
vendor: FreeRDP
product: FreeRDP
affected:
  - FreeRDP >= 3.0.0 < 3.32.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T16:24:47.737920Z'
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:25:12.637Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111378'
references:
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x'
    label: GitHub Security Advisory (GHSA-qpfh-m9w6-xf2x)
  - url: >-
      https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-unauthenticated-memory-exhaustion-via-nla-frame-parser
    label: >-
      VulnCheck Advisory: FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory
      Exhaustion via NLA Frame Parser
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111378.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-111378'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2553907'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-111378'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111378'
tags:
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00515
epssPercentile: 0.43695
ingestedAt: '2026-10-16T01:55:57.993Z'
---

## Overview

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

## Affected

- `FreeRDP >= 3.0.0 < 3.32.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111378.json)