CVE-2026-110833

A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection (RDPDR) channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous data fragments without a termination marker, causing unbounded memory retention in the proxy session. This excessive memory consumption can ultimately lead to a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires an established session with device redirection and a proxy explicitly configured to intercept RDPDR channel traffic, resulting in resource exhaustion without compromising data integrity, confidentiality, or allowing arbitrary code execution. In standard Red Hat deployments, FreeRDP is predominantly utilized as a client application or library rather than an intermediary proxy service. Consequently, typical environments are not exposed to this issue unless the proxy is actively deployed with channel interception enabled. Furthermore, Red Hat Enterprise Linux 8 and 9 are unaffected because they provide earlier FreeRDP versions lacking the vulnerable proxy code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.