FreeRDP 8.3 High-Severity Heap Overflow Allows Unauthenticated Memory Corruption
A high-severity heap out-of-bounds write in FreeRDP versions prior to 3.32.0 enables unauthenticated attackers to exploit the NTLM authentication path without needing valid credentials.
Key points
- FreeRDP versions from 2.0.0 up to 3.32.0 contain a high-severity heap out-of-bounds write vulnerability.
- The flaw resides in the server hash-callback NTLM path and allows unauthenticated remote exploitation.
- Attackers can send crafted messages to write 16 zero bytes beyond the allocated memory buffer.
FreeRDP versions ranging from 2.0.0 before 3.32.0 contain a high-severity vulnerability that allows unauthenticated attackers to exploit the server hash-callback NTLM path. According to the National Vulnerability Database, this flaw is rated 8.3 on the Common Vulnerability Scoring System and is classified as high severity. The issue stems from a failure to validate the MIC offset, which creates a heap out-of-bounds write condition. This weakness is categorized under CWE-787 by the Common Weakness Enumeration scheme.
What is the technical nature of this vulnerability?
The vulnerability exists within the server hash-callback NTLM path of the FreeRDP software. The National Vulnerability Database records that the code fails to properly validate the MIC offset during authentication processing. This lack of validation allows an attacker to manipulate memory structures. Specifically, an unauthenticated attacker can send a crafted AUTHENTICATE_MESSAGE to the server. This message includes a backward session-key offset and a manipulated MIC offset. These parameters trigger the out-of-bounds write condition.
How does an attacker exploit this flaw?
An attacker does not need valid credentials to exploit this vulnerability because the attack vector is unauthenticated. According to the source material, the attacker sends a specifically crafted AUTHENTICATE_MESSAGE to the target system. This message contains a backward session-key offset combined with a manipulated MIC offset. When the server processes this invalid input, it writes 16 zero bytes beyond the intended memory allocation. This heap out-of-bounds write can potentially lead to memory corruption. The exploitation relies entirely on the server's failure to check the bounds of the MIC offset.
Which versions of FreeRDP are affected?
The National Vulnerability Database specifies that FreeRDP versions from 2.0.0 before 3.32.0 are affected by this vulnerability. Any deployment running a version in this range is exposed to the risk. The flaw is present in the server component handling NTLM authentication. Organizations using FreeRDP for remote desktop connections should verify their current version immediately. If the version is earlier than 3.32.0, the system is vulnerable to the heap out-of-bounds write described in CVE-2026-111880.
What is the current status of remediation?
The National Vulnerability Database record for CVE-2026-111880 identifies the vulnerability but does not confirm the availability of a patch or fix. No official update has been stated in the provided source material. Consequently, defenders should assume that no secure version is currently available for immediate deployment. Teams must rely on network-level controls and monitoring to mitigate the risk. Until a vendor-provided update is confirmed, systems running affected versions remain exposed to unauthenticated exploitation attempts.
Detection notes
Security operations teams should monitor for unusual authentication traffic patterns on FreeRDP endpoints. Look for AUTHENTICATE_MESSAGE packets that deviate from standard NTLM negotiation flows. Check server logs for crashes or memory errors occurring during authentication attempts, especially from unauthenticated sources. Investigate any sudden spikes in connection attempts that fail to complete successfully. Verify that network segmentation limits direct access to RDP services from untrusted networks. Ensure that logging captures detailed packet metadata to identify malformed offsets. Review firewall logs for blocked attempts to access RDP ports from unfamiliar IP addresses.
Background: Heap overflow vulnerabilities
Heap overflows occur when a program writes data beyond the boundary of a dynamically allocated memory block. This corrupts adjacent heap metadata or neighboring objects. Attackers exploit this corruption to control function pointers or object structures. The process involves allocation, overflow, metadata poisoning, and controlled deallocation to hijack execution flow.
Read the full guide: How Heap Overflow Vulnerabilities Work: Step-by-Step Exploitation Mechanics
What to do and how to stay safe: FreeRDP
- Inventory all systems running FreeRDP to identify versions prior to 3.32.0.
- Monitor network traffic for unauthenticated attempts to initiate NTLM authentication sessions.
- Restrict access to FreeRDP services using firewalls or network segmentation to trusted networks only.
- Watch for server crashes or memory errors that may indicate exploitation attempts.
Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111880?
The Common Vulnerability Scoring System rate for this vulnerability is 8.3, which is classified as high severity.
Is authentication required to exploit this vulnerability?
No, the National Vulnerability Database states that unauthenticated attackers can exploit this heap out-of-bounds write.
Which FreeRDP versions are vulnerable?
FreeRDP versions from 2.0.0 before 3.32.0 are affected by this vulnerability according to the source material.
