CVE-2026-111880 Details
Description
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
A heap out-of-bounds write vulnerability has been identified in FreeRDP versions 2.0.0 prior to 3.32.0. The issue arises in the server hash-callback NTLM path, where the vulnerability fails to properly validate the Message Integrity Check (MIC) offset. This flaw allows unauthenticated attackers to send a crafted AUTHENTICATE_MESSAGE that includes a backward session-key offset and MIC offset, enabling them to write 16 zero bytes beyond the allocated memory.
Users are advised to update FreeRDP to version 3.32.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FreeRDP | >= 2.0.0, <= 3.31.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |