FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while… (CVE-2026-109680)

FreeRDP versions prior to 3.32.0 have a heap-based out-of-bounds write vulnerability in the freerdp_interruptible_get_line function. The vulnerability arises because the buffer size is reduced to 32 bytes, but the write offset is based on the length of a pre-filled suggested username, potentially leading to a write beyond the allocated heap buffer. This can be triggered by a malicious or compromised ARM routing service that returns a long redirectedUsername, which is processed at the CLI credential prompt, causing the client to crash upon user input.

The vulnerability results in a denial of service condition by crashing the FreeRDP client when the user types input after receiving a long redirectedUsername from a malicious or compromised ARM routing service. There is no indication of confidentiality or integrity impact. The CVSS score of 6.5 reflects a medium severity denial of service impact with network attack vector and no privileges required.

A patch is available for FreeRDP to fix this heap-based out-of-bounds write vulnerability. Users and administrators should update to version 3.32.0 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.