Description
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.
Published: 2026-10-12
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A heap out‑of‑bounds read occurs in the function freerdp_assistance_parse_all_elements_of() when parsing .msrcIncident files. The parser advances its cursor beyond the limit of the decrypted ConnectionString2 buffer, causing xfreerdp to crash before any RDP session is established. This results in a denial of service for the process that reads the malicious file.

Affected Systems

The vulnerability affects the FreeRDP project’s desktop client, with all releases from 3.0.0 up through any pre‑3.32.0 build. No sub‑version granularity is provided beyond the broad 3.0.0 to 3.31.x range.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is not available, so exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require an end‑user to open a crafted .msrcIncident file, which could be delivered via phishing or an untrusted download.

Generated by OpenCVE AI on October 12, 2026 at 19:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to FreeRDP 3.32.0 or newer, which includes the out‑of‑bounds read fix.
  • Do not open or process .msrcIncident files from untrusted or unknown sources; only load files that have been verified as legitimate.
  • Configure the operating system or application to restrict file permissions so that only trusted users can launch xfreerdp with arbitrary files.
  • Enable or review crash‑report logging for xfreerdp to detect attempts to exploit the vulnerability.

Generated by OpenCVE AI on October 12, 2026 at 19:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.
Title FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-125
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T16:56:51.739Z

Reserved: 2026-10-12T14:09:00.052Z

Link: CVE-2026-109249

cve-icon Vulnrichment

Updated: 2026-10-13T15:49:19.763Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-12T17:17:16.077

Modified: 2026-11-02T20:49:19.950

Link: CVE-2026-109249

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-12T16:04:22Z

Links: CVE-2026-109249 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T20:00:15Z

Weaknesses