Heap Out-of-Bounds Write in FreeRDP Server Hash Callback

CVE-2026-111880

What is CVE-2026-111880?

FreeRDP versions prior to 3.32.0 are exposed to a heap out-of-bounds write vulnerability within the server hash callback related to NTLM authentication. This weakness arises due to insufficient validation of the Message Integrity Code (MIC) offset in the AUTHENTICATE_MESSAGE. Attackers, without authentication, may exploit this flaw by supplying a specially crafted session key and corresponding MIC offset, enabling them to write beyond the allocated memory bounds, potentially leading to arbitrary code execution.

References