FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor… (CVE-2026-109249)

The vulnerability in FreeRDP 3.0.0 before 3.32.0 is a heap out-of-bounds read in the freerdp_assistance_parse_all_elements_of() function. The issue arises because the parsing cursor advances without decrementing the remaining length, which lets the scanning window exceed the bounds of the decrypted ConnectionString2 buffer. This flaw can be triggered by an attacker providing a specially crafted .msrcIncident invitation file and password, leading to a crash of the xfreerdp client when the file is opened, prior to establishing any remote desktop connection.

Successful exploitation results in a denial of service (application crash) of the xfreerdp client. There is no indication of confidentiality or integrity impact. The attack requires local vector (user interaction to open a crafted file) and does not allow code execution or data disclosure.

A fix is available in FreeRDP version 3.32.0. Users should upgrade to version 3.32.0 or later to remediate this vulnerability. Until then, avoid opening untrusted .msrcIncident invitation files and passwords with vulnerable versions of xfreerdp.