CVE-2026-109680GHSA-4ww8-3vqm-jgcf
FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username
FreeRDP FreeRDP
CVSS
6.0MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input.
Text from CVE List
Affected versions 2
- FreeRDPaffected: 3.18.0 before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List