Search: CVE-2026-111378

FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain an uncontrolled resource consumption vulnerability in the parse_nla_mode_pdu function. This flaw allows unauthenticated attackers to exhaust server memory by sending TLS streams with bytes that do not start with the expected DER SEQUENCE tag, causing unbounded growth of the receive buffer before NLA authentication. The vulnerability has a high severity with a CVSS score of 7.5 and is fixed in version 3.32.0.