CVE-2026-111378
Description
A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.
Statement
Red Hat Product Security has rated this vulnerability as having an Important impact because an unauthenticated remote attacker can exhaust server memory prior to authentication without requiring valid user credentials or privileges. While FreeRDP packages in Red Hat Enterprise Linux are primarily utilized for client-side connectivity, server implementations and services utilizing FreeRDP server libraries with Network Level Authentication are exposed to denial of service from unbounded buffer growth. Deployments that solely execute FreeRDP as an outbound client remain unaffected.
Mitigation
Restrict network access to systems running FreeRDP server services, or disable the service if remote graphical access is not required.
1. Restrict RDP access to trusted network sources using firewalld:
# firewall-cmd --permanent --zone=public --remove-service=rdp
# firewall-cmd --permanent --zone=trusted --add-source=<trusted_IP_or_CIDR>
# firewall-cmd --reload
2. If remote desktop access is not required, disable the remote desktop service (for example, GNOME Remote Desktop):
# systemctl --user --now mask gnome-remote-desktop.service
Caveats and Warnings:
Reloading firewall configurations applies changes immediately and will drop traffic from unlisted networks, which can disrupt active sessions. Stopping or masking remote desktop services immediately terminates existing user sessions and disables incoming remote desktop connectivity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
