Uncontrolled Memory Exhaustion in FreeRDP via Malformed NLA PDU

Executive Summary

CVE-2026-111378 is an uncontrolled resource consumption vulnerability in FreeRDP versions 3.0.0 to 3.31.1. It allows unauthenticated attackers to exhaust server memory by sending malformed bytes during the TLS handshake before NLA authentication. The parser incorrectly handles invalid DER SEQUENCE tags, causing an infinite loop that grows the receive buffer indefinitely.

Useful 0 Not Useful 0

Detection Guidance

Monitor FreeRDP server processes for excessive memory usage or connection attempts that complete TLS but fail NLA authentication. Check logs for repeated failed authentication attempts or unusual network traffic patterns targeting FreeRDP ports.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service by exhausting server memory and connection-handling resources. It does not lead to data disclosure or memory corruption but can disrupt FreeRDP services by making them unresponsive due to resource exhaustion.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service through memory exhaustion. It does not directly lead to data disclosure or memory corruption. Compliance with standards like GDPR or HIPAA is indirectly affected because service unavailability could violate availability requirements in these regulations, potentially leading to non-compliance if systems fail to maintain expected uptime or data accessibility.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. If upgrading is not possible, disable NLA on FreeRDP servers or restrict network access to FreeRDP ports via firewall rules until patched.

Useful 0 Not Useful 0