CVE-2026-111378: 
Wolfi vulnerability analysis and mitigation

CVE-2026-111378 is an uncontrolled resource consumption vulnerability in FreeRDP's parse_nla_mode_pdu function that allows unauthenticated remote attackers to exhaust server memory, resulting in a denial of service. It affects FreeRDP versions 3.0.0 through 3.31.x, with the fix introduced in version 3.32.0. The vulnerability was published on October 16, 2026, and was assigned by VulnCheck. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Github Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). In libfreerdp/core/transport.c, the function parse_nla_mode_pdu initializes pduLength to zero and only enters its length-decoding branch when the first byte is the DER SEQUENCE tag 0x30; for any other first byte, it returns zero with incomplete set to true. The calling loop in transport_default_read_pdu interprets this zero return as an incomplete-but-valid header and appends one byte at a time, re-parsing from the same invalid first byte indefinitely — with no aggregate buffer cap applied. An attacker only needs to complete the TLS handshake and then stream arbitrary bytes not starting with 0x30, causing the receive buffer to grow without bound before any NLA credential exchange occurs. A proof-of-concept demonstrating 16 MiB of unbounded buffer growth was included in the security advisory (GitHub Advisory).

Successful exploitation results in memory exhaustion on the FreeRDP server process, causing a denial of service. Concurrent unauthenticated connections can consume all available process memory and connection-handling resources without ever reaching the authentication stage. There is no confidentiality or integrity impact — the vulnerability does not bypass NLA, disclose data, or involve memory corruption (GitHub Advisory, Red Hat Bugzilla).

No public exploit code beyond the bounded proof-of-concept included in the FreeRDP security advisory is known at this time. The EPSS score is 0.0, indicating low current probability of exploitation in the wild, and there is no evidence of active in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation is trivially easy — it requires only network access and the ability to complete a TLS handshake, with no credentials, privileges, or user interaction needed (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible FreeRDP server instances (e.g., FreeRDP Shadow) running versions 3.0.0 through 3.31.x using network scanners such as Shodan, Censys, or Nmap targeting RDP port 3389 or custom FreeRDP server ports.
2. Establish TLS connection: Initiate a TCP connection to the target FreeRDP server and complete the TLS handshake. No credentials are required at this stage.
3. Stream malformed NLA bytes: After TLS is established and the server enters NLA mode, begin streaming bytes whose first byte is any value other than the DER SEQUENCE tag 0x30 (e.g., 0x41). This causes parse_nla_mode_pdu to return zero with incomplete=true on every parse attempt.
4. Trigger unbounded buffer growth: Continue streaming data; the transport_default_read_pdu loop appends one byte at a time and retries parsing from the same invalid first byte, causing the receive buffer to grow without limit for as long as data is supplied.
5. Scale the attack: Open multiple concurrent connections performing the same technique to amplify memory consumption and accelerate denial of service against the target server (GitHub Advisory).

• Network: High volume of inbound TLS connections to the FreeRDP server port that do not progress to RDP credential negotiation; connections that remain open for extended periods without completing NLA authentication.
• Process: Rapidly increasing memory consumption by the FreeRDP server process (e.g., freerdp-shadow) without a corresponding increase in authenticated sessions; process memory growing monotonically over time.
• Logs: FreeRDP server logs showing repeated NLA frame parsing attempts on the same connection without successful authentication; absence of credential exchange events for long-lived connections.
• System: Out-of-memory (OOM) killer events in system logs (/var/log/syslog, dmesg) targeting the FreeRDP server process; sudden termination of the FreeRDP server process due to memory exhaustion (GitHub Advisory).

Upgrade FreeRDP to version 3.32.0 or later, which contains the fix for this vulnerability. The recommended remediation is to make parse_nla_mode_pdu return a fatal framing error when the first available byte is not the permitted DER SEQUENCE tag 0x30, and to add a conservative aggregate cap for buffered authentication frames. As a temporary workaround where upgrading is not immediately possible, consider restricting network access to FreeRDP server ports using firewall rules to limit exposure to trusted IP ranges, or disabling NLA if operationally feasible. FreeRDP Shadow enables NLA by default, so all deployments using the shadow server on versions 3.0.0–3.31.x should be treated as affected (GitHub Advisory, Red Hat Bugzilla).

Red Hat has opened a tracking bug (Bug 2553907) for this vulnerability, classifying it as high severity and high priority for their product security team. The vulnerability was credited to researchers Kushalkhemka, opensec-intelligence, mayank-jangid-moon, and skigeek16. No significant broader media coverage or notable social media commentary has been identified at this time (Red Hat Bugzilla, GitHub Advisory).