CVE-2026-111377 [MEDIUM] – FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProc

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.