Is CVE-2026-110832 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110832 being exploited in the wild.

How severe is CVE-2026-110832?

Medium severity, with a CVSS score of 6.5, published 14 October 2026.

Which products and versions are affected?

FreeRDP Project FreeRDP 2.0.0 through 3.31.1.

How is CVE-2026-110832 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110832?

Check whether you run FreeRDP or FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110832: FreeRDP memory exhaustion in DRDYNVC DATA_FIRST

CVE-2026-110832 · Severity: medium · CVSS 6.5 · Published 2026-10-14

FreeRDP is a remote desktop protocol library used in many open-source and commercial RDP clients and servers. An authenticated attacker can send specially crafted messages to exhaust server memory, causing performance degradation or service outages. The vulnerability requires the attacker to have valid credentials and an established session, limiting the immediate risk but creating a potential denial-of-service vector for multi-user systems.

Technologies: FreeRDP, FreeRDP Project FreeRDP. Vendors: FreeRDP, FreeRDP Project.

Quick answers

Is CVE-2026-110832 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110832 being exploited in the wild.
How severe is CVE-2026-110832?: Medium severity, with a CVSS score of 6.5, published 14 October 2026.
Which products and versions are affected?: FreeRDP Project FreeRDP 2.0.0 through 3.31.1.
Is there a fix for CVE-2026-110832?: Yes: fixed in FreeRDP 3.32.0. Until then: Restrict RDP access to trusted users only; implement network-level rate limiting on DVC messages or per-session memory budgets at the application level while awaiting the upstream patch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110832 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110832?: Check whether you run FreeRDP or FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FreeRDP 3.32.0

Restrict RDP access to trusted users only; implement network-level rate limiting on DVC messages or per-session memory budgets at the application level while awaiting the upstream patch.

Technical details

The wts_read_drdynvc_data_first function in FreeRDP trusts the client's 32-bit declared message length without validation, pre-allocating and zeroing memory via Stream_EnsureCapacity before the actual message body arrives. An authenticated client can send a seven-byte DATA_FIRST message on an opened DVC (Dynamic Virtual Channel) declaring a large size (e.g., 256 MiB or 4 GiB), forcing the server to commit resident memory that is never freed if the message is incomplete or rejected. A fix was available in version 3.32.0 implementing per-message size limits and memory accounting.

Affected products

FreeRDP Project FreeRDP 2.0.0 through 3.31.1

Timeline

2026-09-30: advisory
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.