CVE-2026-110833GHSA-m7g5-gw57-cwcr

FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

FreeRDP FreeRDP

CVSS

8.2High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.32.0Fixed versionCVE List

Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

3.32.0FreeRDPCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragmentTelegram: CVE Notify, 23 Oct 2026

Description

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.

Text from CVE List

Affected versions 2

FreeRDPaffected: 3.0.0-beta1 before 3.32.0CVE List
FreeRDPunaffected: 3.32.0CVE List