CVE-2026-109249
Received Received - Intake

Heap Out-of-Bounds Read in FreeRDP

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109249
EUVD
EUVD-2026-97693

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109249 is a heap out-of-bounds read flaw in FreeRDP affecting versions up to 3.31.1. The issue occurs in the function freerdp_assistance_parse_all_elements_of() when parsing crafted Remote Assistance (.msrcIncident) files. The function advances its parsing cursor without reducing the remaining buffer length, causing the scan window to exceed the allocated heap memory. This leads to a crash when strnlen() is called to re-derive the length.

Detection Guidance

To detect this vulnerability, check the FreeRDP version installed on your system. Run: freerdp2-xfreerdp --version or apt list --installed | grep freerdp. If the version is below 3.32.0, the system is vulnerable. Monitor for crashes when opening .msrcIncident files.

Impact Analysis

An attacker can exploit this by providing a malicious .msrcIncident invitation file and password. When opened, this crashes the xfreerdp client before any RDP connection is established, causing a denial of service. The impact is limited to client-side crashes and does not appear to allow code execution or data exfiltration.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Remove or restrict access to .msrcIncident files until patched. Apply the patch from the FreeRDP repository commit 2a737ce14dfee036a12d2d3e87473ace3e20349b.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart