CVE-2026-109249: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdpassistanceparseallelementsof() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which deployments are affected?
FreeRDP versions from 3.0.0 before 3.32.0 are affected when xfreerdp is used to open Remote Assistance .msrcIncident invitation files.
What must an attacker provide to trigger the issue?
An attacker needs to provide a crafted .msrcIncident invitation file and its password. Exploitation requires a local user to open the invitation in xfreerdp; no RDP connection needs to be established.
What is the expected impact?
The supplied data can cause xfreerdp to crash through a heap out-of-bounds read while parsing the decrypted ConnectionString2 buffer. The provided severity vector indicates local attack access and user interaction, with availability impact but no stated confidentiality or integrity impact.
What version should be used to remediate the issue?
Upgrade FreeRDP to version 3.32.0 or later. The affected range is 3.0.0 before 3.32.0.