CVE-2026-110832

A flaw was found in FreeRDP. An authenticated remote client can trigger excessive memory consumption on the server by sending a crafted Dynamic Virtual Channel (DVC) message with an arbitrarily large declared length. Because the server immediately allocates and initializes the requested memory before the full payload is received, an attacker can exhaust system resources and cause a Denial of Service (DoS).

This flaw is rated Moderate because an authenticated client can cause FreeRDP server memory exhaustion via crafted DVC messages (A:H). Privileges required are Low; confidentiality and integrity are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.