{"id":"CVE-2026-109249","summary":"FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing","details":"FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.","aliases":["GHSA-gvq8-v2fm-ffxv"],"modified":"2026-10-14T07:05:45.619342216Z","published":"2026-10-12T16:04:22.914Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109249.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109249.json"},{"type":"ADVISORY","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gvq8-v2fm-ffxv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109249"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-heap-out-of-bounds-read-via-remote-assistance-file-parsing"},{"type":"FIX","url":"https://github.com/FreeRDP/FreeRDP/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freerdp/freerdp","events":[{"introduced":"a34fa7c49d2a39aa49ace1d7bea9656912d8c7cb"},{"fixed":"d27a4f7c1c63b62a5e60e5d939ad116cfb58ffc1"},{"fixed":"2a737ce14dfee036a12d2d3e87473ace3e20349b"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.32.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["3.5.1","3.5.0","3.4.0","3.3.0","3.2.0","3.1.0","3.0.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/freerdp/freerdp/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b","target":{"file":"libfreerdp/common/assistance.c"},"deprecated":false,"digest":{"line_hashes":["283094985821492808719438155652375325131","172743792890273580127720369993309544701","157719949658301151831493847260804322936","84364854949895500329684016493905583049","66685747996303995670690505712100932664","328678656113030407207151896877458551668","73828588283782060544038799002476735649","197184171098073115612128979207625447441","59690596987037686927309837314159622085","74135226986682029411020387865066614791","112110530168114271125340566577674709181","105490496135081323454781843871328563251","66556989487769594507790643548747253866","17194306142640840589095396656685639224","161563258348631126309798874939221999641","19789210331740501251861334015464298160","143922997549980473929470405980961785760","103161761194740284504277360312836623427","239208520402177053256963309175491576628","138672603396381993176331342034584317375","234145779002226655730472947373327898283","149060249560539327779436969065360914957","174864680265462819540294243057824061449","199019432172880605396700409572769302904","18630860191313773834744555759328782744","11115353639032552291233892644250525559","112137384298943308353905897260135496305","210047160854641179160620521228574934689","47904762584573182897268249922294661159","23871308905891831497332523051481196963","36052832372205137897885703835650228392","311267807500934612756342919376024521104","307991695467972398942071881470945231281","89283910595693152438502797460035657955","306696736580303419822997049028362204015","5589286261027377917074325364133657499","131443630433465581450294498692350641194","334245003643591495131410429742299007491","177393602628933267335277364180310654876","303846399060643224564437546142035412544","1463804340046751598390448944845661444","128393039622392060377197013007844401885","270723039765413652584504657459364354198","47914919696380866129584983862638850815","55383170814588654672970421231158452653","253866750877055032540818439093000156931","127317976554979063780976899388107586411","295058182791882639209899694696488377163","279934928580660533675746713992828400921","37317306843033310048295569278312777975","267603251600986354410058267258130125211","140709076975094642930947410295713611586","198890067812714289282653056638913277968","205153772931121483720155802069393062514","317775582016090167627202428604137485569","177402406298936170986360164735619022926","153321863412728516603551561285545812656","221166871624678089405524941637428113702","91265219800018368178886676300168111056","278315367671010063023666098439215075590","34107723654391505559071984395263723905","180147483872408287258727848262841950465","130466086056214145393079570243415954343","122819439276003155136184702254416485018","257183262040947102162843839008382437804","41962371912754524929091765041640099623","67399380832527123143517012697140098514","33645172995081095486111184393123467738","45632464059772028367743544789900145842","268884455913043334147929585529533854883","2142690373032222266170255892966826638","38293587747221870516221003995596346768","286912316695181335859479405824163092883","46830089579463956005388925104575119804","204504137286411291112239923111604863488","254921727648520116770656226988159233872","70881059537476562735499324600197463","328937426405501174444536955441361157721","265320001415581855630892359340016009346","303253955643479699684870907298510147638","211146076771209926704092324414046940511","297637763194273270552871647668384475730","26365313171306839075278451005617159830","58269296739385472087093225063435852969","30327968009014886377075641394552152951","295236280278030123199684950936114145081","252858424632741880795255914581859532383","69310622597236929291921483334334790978","304768622368822663686042838637856394025","51364644039306670307833256893146841525","27395249015743120465856320673932244985","314752831244030069060989144996613870280","133592736369649142758966035360935849712","54866555549549333641740770601237141486","18065875218045431427407665905757536905","136218198561089064222131585503398419647","50756346804709469251026772541237761099","115239959946920399086409168649960791837"],"threshold":0.9},"id":"CVE-2026-109249-82abf8f2","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"233029176299796059330351857316364297639","length":429},"id":"CVE-2026-109249-d1d2bdf0","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b","target":{"file":"libfreerdp/common/assistance.c","function":"freerdp_assistance_parse_all_elements_of"},"deprecated":false},{"target":{"file":"libfreerdp/common/assistance.c","function":"freerdp_assistance_file_free"},"deprecated":false,"digest":{"function_hash":"72951201631970173621384749828444757910","length":671},"id":"CVE-2026-109249-def56def","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/2a737ce14dfee036a12d2d3e87473ace3e20349b"}],"vanir_signatures_modified":"2026-10-14T07:05:45Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109249.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}