CVE-2026-109255GHSA-hxw3-57rq-3v4m
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
FreeRDP FreeRDP
CVSS
6.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution.
Text from CVE List
Affected versions 2
- FreeRDPaffected: 3.0.0 before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List