CVE-2026-111880 is a high severity (CVSS 7.4) heap out-of-bounds write in FreeRDP from 2.0.0 before 3.32.0. A crafted NTLM authenticate message can make a server that uses the hash callback write 16 zero bytes outside an allocation. Upgrade to 3.32.0.
What's affected
FreeRDP 2.0.0 up to and including 3.31.1. The GitHub advisory lists 3.32.0 as the patched version, and the record and VulnCheck agree on the range.
The path is narrow. It affects FreeRDP used as an RDP server or proxy whose peer configuration supplies SspiNtlmHashCallback. The advisory says the reproduced result is a fixed 16 byte zero write, and it does not claim code execution. It is not a password bypass or a TLS failure, and the client side is not the target here.
Scoring note: the record's 7.4 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.3 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Find which FreeRDP you have. On a host with the client installed, the version command shows it:
xfreerdp /version
For distribution packages, query the package manager, for example dpkg -l freerdp3-x11 or rpm -q freerdp. Also check applications that embed FreeRDP as a library, since the application's own version will not tell you.
Then ask whether you run a FreeRDP based server or proxy with NTLM hash callback authentication. If not, the vulnerable path is not in use.
What to do now
- List software that bundles or links FreeRDP, including proxies and gateways.
- Upgrade to FreeRDP 3.32.0 or a distribution build that backports the fix.
- Rebuild and redeploy any application that statically links the library.
- Restrict network access to RDP servers and proxies to trusted clients.
- Check your distribution's security tracker if you cannot move to 3.32.0.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-787, an out-of-bounds write. The parser accepts a field offset that points backward in the message and records a length that does not match the buffer it later writes into. The write lands before authentication completes, so the sender needs no credentials.
Memory corruption in a network facing authentication step deserves a prompt upgrade even when the demonstrated effect is limited. Do not assume it stays limited on every build. It is not listed in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect every FreeRDP client?
No. The advisory describes the server or proxy hash callback path, not the usual client use.
Is code execution confirmed?
The advisory says the reproduced primitive is a fixed 16 byte zero write and that code execution is not claimed.
Sources
Last reviewed: 18 October 2026.
