CVE-2026-109255: FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients from 3.0.0 before 3.32.0 are affected when running on 32-bit systems. The issue is triggered by connecting to a malicious RDP server.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that the target client connects to. Exploitation requires user interaction because the client must initiate the RDP connection.
What is the impact of successful exploitation?
A crafted SERVER_LICENSE_REQUEST with a large scopeCount can cause heap out-of-bounds writes. This may result in denial of service or remote code execution on the affected client.
How can I determine whether a deployment is affected?
Check whether the FreeRDP version is 3.0.0 or later but earlier than 3.32.0, and whether it runs as a 32-bit client. Systems outside that version range or not using a 32-bit client are not identified as affected by the provided information.