Is CVE-2026-111377 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111377?

CVE-2026-111377 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111377

Description

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.