CVE-2026-109255: FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

Q: Which systems are exposed to this issue?

FreeRDP clients from 3.0.0 before 3.32.0 are affected when running on 32-bit systems. The issue is triggered by connecting to a malicious RDP server.

Q: What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that the target client connects to. Exploitation requires user interaction because the client must initiate the RDP connection.

Q: What is the impact of successful exploitation?

A crafted SERVER_LICENSE_REQUEST with a large scopeCount can cause heap out-of-bounds writes. This may result in denial of service or remote code execution on the affected client.

Q: How can I determine whether a deployment is affected?

Check whether the FreeRDP version is 3.0.0 or later but earlier than 3.32.0, and whether it runs as a 32-bit client. Systems outside that version range or not using a 32-bit client are not identified as affected by the provided information.

Published Oct 12, 2026

Updated

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Event

via NVD·06:11 PM

Frequently Asked Questions

Which systems are exposed to this issue?

FreeRDP clients from 3.0.0 before 3.32.0 are affected when running on 32-bit systems. The issue is triggered by connecting to a malicious RDP server.

What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that the target client connects to. Exploitation requires user interaction because the client must initiate the RDP connection.

What is the impact of successful exploitation?

A crafted SERVER_LICENSE_REQUEST with a large scopeCount can cause heap out-of-bounds writes. This may result in denial of service or remote code execution on the affected client.

How can I determine whether a deployment is affected?

Check whether the FreeRDP version is 3.0.0 or later but earlier than 3.32.0, and whether it runs as a 32-bit client. Systems outside that version range or not using a 32-bit client are not identified as affected by the provided information.

CVE-2026-109255: FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can I determine whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can I determine whether a deployment is affected?