Integer Truncation Vulnerability in FreeRDP Affects Remote Desktop Protocol Functionality
CVE-2026-109255

6.1MEDIUM

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109255?

FreeRDP versions prior to 3.32.0 are susceptible to an integer truncation vulnerability found in the license_check_stream_length function. This flaw allows a malicious RDP server to manipulate the length of SERVER_LICENSE_REQUEST messages, sending a large scopeCount value that circumvents length validations. This can trigger a heap buffer overflow on 32-bit client systems, leading to potential denial of service attacks or remote code execution. It is essential for users to upgrade to the latest version to mitigate these risks.

Affected Version(s)

FreeRDP 3.0.0 < 3.32.0

FreeRDP 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before...
third-party-advisory

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D7EAD
.