CVE-2026-110832: FreeRDP: DVC DATA_FIRST memory exhaustion causes DoS

MEDIUMCISA: TRACK*

Published October 14, 2026

CISO Take

FreeRDP versions 2.0.0 through 3.31.x contain a flaw in the dynamic virtual channel handler that lets any authenticated client send a seven-byte DATA_FIRST message declaring a huge length, forcing the server to commit large zeroed memory allocations and exhaust resources. The CVSS is a moderate 6.5 with availability impact only; there is no confidentiality or integrity loss, no CISA KEV listing, no public exploit, no Nuclei template, and no EPSS data yet. FreeRDP is a general remote desktop library rather than an AI/ML component, so it matters to AI teams mainly where it underpins remote GPU workstations, notebook hosts, VDI for data scientists, or browser or computer-use agent sandboxes that expose RDP. Upgrade to FreeRDP 3.32.0 or later, limit RDP access to trusted networks and accounts, and set memory limits on RDP-serving processes so one session cannot take down the host.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium overall. The attack is low complexity and network reachable, but it needs valid low-privilege credentials, and the impact is limited to availability. There is no known exploitation, no public PoC, and no KEV or SSVC signal. Exposure of the AI/ML workload is indirect: risk rises only if FreeRDP-based servers front GPU hosts, shared notebook or training workstations, or agent sandboxes. The AI category tag is weak, and package context is unknown (risk score 0/100, no dependent data).

How does the attack unfold?

Initial Access

Attacker authenticates to a FreeRDP-based server with valid low-privilege credentials.

AML.T0012

Exploitation

Attacker opens a dynamic virtual channel and sends a seven-byte DATA_FIRST message declaring a very large 32-bit length.

AML.T0049

Resource Exhaustion

The server commits large zeroed allocations, and repeated messages drive resident memory growth until the host is starved.

Impact

Remote access and co-located AI/ML workloads become unavailable or are killed by the OOM handler.

AML.T0029

Initial Access

Attacker authenticates to a FreeRDP-based server with valid low-privilege credentials.

AML.T0012

Exploitation

Attacker opens a dynamic virtual channel and sends a seven-byte DATA_FIRST message declaring a very large 32-bit length.

AML.T0049

Resource Exhaustion

The server commits large zeroed allocations, and repeated messages drive resident memory growth until the host is starved.

Impact

Remote access and co-located AI/ML workloads become unavailable or are killed by the OOM handler.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
FreeRDP	—	—	No patch

Do you use FreeRDP? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade FreeRDP to 3.32.0 or later, as noted in GHSA-5cgr-vmp8-fmvj. 2) Inventory products and containers that embed FreeRDP (RDP gateways, VDI brokers, remote-desktop servers, agent browser sandboxes) and check their bundled versions. 3) Restrict RDP exposure to VPN or allow-listed networks, enforce MFA and remove stale low-privilege accounts. 4) Set cgroup or container memory limits and OOM-priority protections on RDP-serving processes, and isolate them from training and inference workloads. 5) Detect by alerting on abrupt resident memory growth in RDP server processes, OOM events, and sessions that open dynamic virtual channels and send very small DATA_FIRST messages with large declared lengths.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAML.T0012- Valid Accounts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and managing AI system availability

Frequently Asked Questions

What is CVE-2026-110832?

Is CVE-2026-110832 actively exploited?

No confirmed active exploitation of CVE-2026-110832 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110832?

1) Upgrade FreeRDP to 3.32.0 or later, as noted in GHSA-5cgr-vmp8-fmvj. 2) Inventory products and containers that embed FreeRDP (RDP gateways, VDI brokers, remote-desktop servers, agent browser sandboxes) and check their bundled versions. 3) Restrict RDP exposure to VPN or allow-listed networks, enforce MFA and remove stale low-privilege accounts. 4) Set cgroup or container memory limits and OOM-priority protections on RDP-serving processes, and isolate them from training and inference workloads. 5) Detect by alerting on abrupt resident memory growth in RDP server processes, OOM events, and sessions that open dynamic virtual channels and send very small DATA_FIRST messages with large declared lengths.

What systems are affected by CVE-2026-110832?

This vulnerability affects the following AI/ML architecture patterns: Remote GPU workstations and VDI for data science, Agent computer-use sandboxes, Shared notebook and training hosts.

What is the CVSS score for CVE-2026-110832?

CVE-2026-110832 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

Remote GPU workstations and VDI for data scienceAgent computer-use sandboxesShared notebook and training hosts

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident memory growth and server resource exhaustion.

Exploitation Scenario

An attacker who has obtained low-privilege credentials, for example through phishing or credential reuse, connects to a FreeRDP-based server that provides remote access to a shared GPU workstation or an AI agent sandbox. After opening a dynamic virtual channel, they send a seven-byte DATA_FIRST message declaring a very large 32-bit length. The server commits a large zeroed allocation per message, and repeating this across channels or sessions rapidly exhausts memory. The host stalls or kills processes, interrupting notebook sessions, training jobs or agent workflows that share it.

Weaknesses (CWE)

CWE-400Uncontrolled Resource ConsumptionPrimary CWE-400Uncontrolled Resource Consumption

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.