CVE-2026-109249GHSA-gvq8-v2fm-ffxv
FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing
FreeRDP FreeRDP
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.
Text from CVE List
Affected versions 2
- FreeRDPaffected: 3.0.0 before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List
References 3
- github.com/FreeRDP/FreeRDP/commit/2a737ce14dfee036a12d2d3e87473ace3e20349bFixvia CVE List
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gvq8-v2fm-ffxvAdvisoryvia CVE List
- vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-heap-out-of-bounds-read-via-remote-assistance-file-parsingAdvisoryvia CVE List