CVE-2026-111377
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 16, 2026
Vendor
unknown
Description
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.