CVE-2026-111378

A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exhausting server memory. When processing Network Level Authentication (NLA) connections over Transport Layer Security (TLS), the server misinterprets invalid protocol bytes as an incomplete packet rather than rejecting them. This triggers unbounded receive buffer growth as incoming data is streamed, consuming server memory until the service becomes unresponsive or crashes.

Red Hat Product Security has rated this vulnerability as having an Important impact because an unauthenticated remote attacker can exhaust server memory prior to authentication without requiring valid user credentials or privileges. While FreeRDP packages in Red Hat Enterprise Linux are primarily utilized for client-side connectivity, server implementations and services utilizing FreeRDP server libraries with Network Level Authentication are exposed to denial of service from unbounded buffer growth. Deployments that solely execute FreeRDP as an outbound client remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to systems running FreeRDP server services, or disable the service if remote graphical access is not required.

1. Restrict RDP access to trusted network sources using firewalld:

firewall-cmd --permanent --zone=public --remove-service=rdp

firewall-cmd --permanent --zone=trusted --add-source=<trusted_IP_or_CIDR>

firewall-cmd --reload

2. If remote desktop access is not required, disable the remote desktop service (for example, GNOME Remote Desktop):

systemctl --user --now mask gnome-remote-desktop.service

Caveats and Warnings: Reloading firewall configurations applies changes immediately and will drop traffic from unlisted networks, which can disrupt active sessions. Stopping or masking remote desktop services immediately terminates existing user sessions and disables incoming remote desktop connectivity.