CVE-2026-111880— FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP 2.0.0 至 3.32.0 之前的版本在服务器端 NTLM 哈希回调路径中存在堆越界写入漏洞。该漏洞源于未对 MIC（消息完整性校验）偏移量进行验证。未认证的攻击者可发送特制的 AUTHENTICATE_MESSAGE，利用反向的会话密钥偏移量和 MIC 偏移量，在已分配内存之外写入 16 个零字节。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111880
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111880
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111880
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111880 (2)
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-111881
FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer -
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV -
CVE-2026-111381
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Ca -
CVE-2026-111380
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple B -
CVE-2026-111379
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_ca
Same vendor: FreeRDP
-
CVE-2026-111881
FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer -
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV -
CVE-2026-111381
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Ca -
CVE-2026-111380
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple B -
CVE-2026-111379
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_ca
Same weakness: CWE-787
-
CVE-2026-112060
librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via -
CVE-2026-112059
libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema -
CVE-2026-112018
cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_access -
CVE-2026-112012
libtta through 2.3 Stack Out-of-Bounds Write via Zero Channe -
CVE-2026-112007
Schism Tracker through 20260524 Heap Out-of-Bounds Write via
V. Comments for CVE-2026-111880
No comments yet