CVE-2026-109249: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing

Q: Which deployments are affected?

FreeRDP versions from 3.0.0 before 3.32.0 are affected when xfreerdp is used to open Remote Assistance .msrcIncident invitation files.

Q: What must an attacker provide to trigger the issue?

An attacker needs to provide a crafted .msrcIncident invitation file and its password. Exploitation requires a local user to open the invitation in xfreerdp; no RDP connection needs to be established.

Q: What is the expected impact?

The supplied data can cause xfreerdp to crash through a heap out-of-bounds read while parsing the decrypted ConnectionString2 buffer. The provided severity vector indicates local attack access and user interaction, with availability impact but no stated confidentiality or integrity impact.

Q: What version should be used to remediate the issue?

Upgrade FreeRDP to version 3.32.0 or later. The affected range is 3.0.0 before 3.32.0.

Published Oct 12, 2026

Updated

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdpassistanceparseallelementsof() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

FreeRDP versions from 3.0.0 before 3.32.0 are affected when xfreerdp is used to open Remote Assistance .msrcIncident invitation files.

What must an attacker provide to trigger the issue?

An attacker needs to provide a crafted .msrcIncident invitation file and its password. Exploitation requires a local user to open the invitation in xfreerdp; no RDP connection needs to be established.

What is the expected impact?

The supplied data can cause xfreerdp to crash through a heap out-of-bounds read while parsing the decrypted ConnectionString2 buffer. The provided severity vector indicates local attack access and user interaction, with availability impact but no stated confidentiality or integrity impact.

What version should be used to remediate the issue?

Upgrade FreeRDP to version 3.32.0 or later. The affected range is 3.0.0 before 3.32.0.

CVE-2026-109249: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker provide to trigger the issue?

What is the expected impact?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker provide to trigger the issue?

What is the expected impact?

What version should be used to remediate the issue?