Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110833FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

Medium 5.9

In plain English

A medium-severity uncontrolled resource consumption in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-devel2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-libs2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-server2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10libwinpr2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10libwinpr-devel2:3.32.2-1.el10_2ALSA-2026:94514
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-110833
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-110833
Debian:14freerdp33.32.0+dfsg-1DEBIAN-CVE-2026-110833
Rocky Linux:10freerdp2:3.32.2-1.el10_2RLSA-2026:94514
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-110833
Ubuntu:24.04:LTSfreerdp33.32.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-110833
Ubuntu:26.04:LTSfreerdp33.32.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-110833

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 3.0.0-beta1 – before 3.32.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References