CVE-2026-109680: FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username
FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients from 3.18.0 before 3.32.0 are exposed when they use ARM routing and receive a redirected username from a malicious or compromised ARM routing service. The redirected username must reach the CLI credential prompt.
What must happen for exploitation to occur?
An attacker needs control of, or the ability to compromise, the ARM routing service so it returns a long redirectedUsername. The user must then type input at the CLI credential prompt, which triggers the out-of-bounds write and can crash the client.
Is a standard FreeRDP connection necessarily affected?
No. The described path specifically requires ARM routing, a long redirected username supplied by the routing service, and interaction with the CLI credential prompt. The provided information does not indicate that connections without this flow are affected.
What can be done if upgrading is not immediately possible?
Avoid using ARM routing services that are not trusted, and do not proceed through the CLI credential prompt when an unexpected redirected username is presented. This reduces exposure to the malicious redirectedUsername input described.