CVE-2026-109249

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109249
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109249.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109249
Aliases
  • GHSA-gvq8-v2fm-ffxv
Downstream
Published
2026-10-12T16:04:22Z
Modified
2026-10-28T11:06:20Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing
Details

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109249.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
a34fa7c49d2a39aa49ace1d7bea9656912d8c7cb
Fixed
d27a4f7c1c63b62a5e60e5d939ad116cfb58ffc1
Fixed
2a737ce14dfee036a12d2d3e87473ace3e20349b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.32.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "2a737ce14dfee036a12d2d3e87473ace3e20349b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109249.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283094985821492808719438155652375325131",
                "172743792890273580127720369993309544701",
                "157719949658301151831493847260804322936",
                "84364854949895500329684016493905583049",
                "66685747996303995670690505712100932664",
                "328678656113030407207151896877458551668",
                "73828588283782060544038799002476735649",
                "197184171098073115612128979207625447441",
                "59690596987037686927309837314159622085",
                "74135226986682029411020387865066614791",
                "112110530168114271125340566577674709181",
                "105490496135081323454781843871328563251",
                "66556989487769594507790643548747253866",
                "17194306142640840589095396656685639224",
                "161563258348631126309798874939221999641",
                "19789210331740501251861334015464298160",
                "143922997549980473929470405980961785760",
                "103161761194740284504277360312836623427",
                "239208520402177053256963309175491576628",
                "138672603396381993176331342034584317375",
                "234145779002226655730472947373327898283",
                "149060249560539327779436969065360914957",
                "174864680265462819540294243057824061449",
                "199019432172880605396700409572769302904",
                "18630860191313773834744555759328782744",
                "11115353639032552291233892644250525559",
                "112137384298943308353905897260135496305",
                "210047160854641179160620521228574934689",
                "47904762584573182897268249922294661159",
                "23871308905891831497332523051481196963",
                "36052832372205137897885703835650228392",
                "311267807500934612756342919376024521104",
                "307991695467972398942071881470945231281",
                "89283910595693152438502797460035657955",
                "306696736580303419822997049028362204015",
                "5589286261027377917074325364133657499",
                "131443630433465581450294498692350641194",
                "334245003643591495131410429742299007491",
                "177393602628933267335277364180310654876",
                "303846399060643224564437546142035412544",
                "1463804340046751598390448944845661444",
                "128393039622392060377197013007844401885",
                "270723039765413652584504657459364354198",
                "47914919696380866129584983862638850815",
                "55383170814588654672970421231158452653",
                "253866750877055032540818439093000156931",
                "127317976554979063780976899388107586411",
                "295058182791882639209899694696488377163",
                "279934928580660533675746713992828400921",
                "37317306843033310048295569278312777975",
                "267603251600986354410058267258130125211",
                "140709076975094642930947410295713611586",
                "198890067812714289282653056638913277968",
                "205153772931121483720155802069393062514",
                "317775582016090167627202428604137485569",
                "177402406298936170986360164735619022926",
                "153321863412728516603551561285545812656",
                "221166871624678089405524941637428113702",
                "91265219800018368178886676300168111056",
                "278315367671010063023666098439215075590",
                "34107723654391505559071984395263723905",
                "180147483872408287258727848262841950465",
                "130466086056214145393079570243415954343",
                "122819439276003155136184702254416485018",
                "257183262040947102162843839008382437804",
                "41962371912754524929091765041640099623",
                "67399380832527123143517012697140098514",
                "33645172995081095486111184393123467738",
                "45632464059772028367743544789900145842",
                "268884455913043334147929585529533854883",
                "2142690373032222266170255892966826638",
                "38293587747221870516221003995596346768",
                "286912316695181335859479405824163092883",
                "46830089579463956005388925104575119804",
                "204504137286411291112239923111604863488",
                "254921727648520116770656226988159233872",
                "70881059537476562735499324600197463",
                "328937426405501174444536955441361157721",
                "265320001415581855630892359340016009346",
                "303253955643479699684870907298510147638",
                "211146076771209926704092324414046940511",
                "297637763194273270552871647668384475730",
                "26365313171306839075278451005617159830",
                "58269296739385472087093225063435852969",
                "30327968009014886377075641394552152951",
                "295236280278030123199684950936114145081",
                "252858424632741880795255914581859532383",
                "69310622597236929291921483334334790978",
                "304768622368822663686042838637856394025",
                "51364644039306670307833256893146841525",
                "27395249015743120465856320673932244985",
                "314752831244030069060989144996613870280",
                "133592736369649142758966035360935849712",
                "54866555549549333641740770601237141486",
                "18065875218045431427407665905757536905",
                "136218198561089064222131585503398419647",
                "50756346804709469251026772541237761099",
                "115239959946920399086409168649960791837"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109249-82abf8f2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b",
        "target": {
            "file": "libfreerdp/common/assistance.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "233029176299796059330351857316364297639",
            "length": 429
        },
        "id": "CVE-2026-109249-d1d2bdf0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b",
        "target": {
            "file": "libfreerdp/common/assistance.c",
            "function": "freerdp_assistance_parse_all_elements_of"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "72951201631970173621384749828444757910",
            "length": 671
        },
        "id": "CVE-2026-109249-def56def",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b",
        "target": {
            "file": "libfreerdp/common/assistance.c",
            "function": "freerdp_assistance_file_free"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:20Z"