CVE-2026-111880
Received Received - Intake

Heap Out-of-Bounds Write in FreeRDP NTLM Authentication

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111880
EUVD
EUVD-2026-103338

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111880 is a heap out-of-bounds write vulnerability in FreeRDP versions 2.0.0 to 3.31.1. It occurs in the NTLM server hash-callback path due to unvalidated MIC offset in AUTHENTICATE_MESSAGE. Attackers can send crafted messages with backward session-key and MIC offsets to write 16 zero bytes beyond allocated heap memory.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for unusual NTLM authentication attempts. Use 'xfreerdp --version' or 'apt list --installed | grep freerdp' to check installed versions. Monitor network traffic for crafted AUTHENTICATE_MESSAGE packets with backward session-key or MIC offsets.

Impact Analysis

This flaw could lead to remote code execution or denial of service by corrupting heap metadata. It may enable further exploitation like double-free scenarios. Servers or proxies using SspiNtlmHashCallback are specifically affected.

Compliance Impact

This vulnerability could potentially lead to remote code execution or denial of service, which may compromise data confidentiality and integrity. For GDPR, this could result in unauthorized access to personal data, violating principles of data protection and security. For HIPAA, it may risk unauthorized disclosure of protected health information, impacting compliance with security requirements.

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later. Disable NTLM authentication if possible by configuring servers to use Kerberos or other secure protocols. Block external access to FreeRDP services until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart