FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to… (CVE-2026-109255)

The vulnerability in FreeRDP 3.0.0 before 3.32.0 arises from an integer truncation issue in the license_check_stream_length function. A malicious RDP server can exploit this by sending a SERVER_LICENSE_REQUEST message with an excessively large scopeCount, which bypasses internal length validations. This causes out-of-bounds writes on the heap in 32-bit client environments, resulting in a buffer overflow. The flaw can be exploited to cause application crashes (denial of service) or potentially execute arbitrary code remotely.

Successful exploitation can lead to denial of service or remote code execution on affected 32-bit FreeRDP clients. The vulnerability does not affect confidentiality but impacts integrity and availability. The CVSS 3.1 base score is 6.8, indicating a medium severity level with network attack vector, high attack complexity, no privileges required, and user interaction required.

A fix is available in FreeRDP version 3.32.0. Users and administrators should upgrade affected FreeRDP clients to version 3.32.0 or later to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the version information in the description. Until upgraded, avoid connecting to untrusted RDP servers.