CVE-2026-109255

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0

Description An integer truncation issue exists in the license check stream length() function. A malicious RDP server can exploit this by sending a crafted SERVER LICENSE REQUEST containing a large scopeCount value. This bypasses length checks and triggers a heap buffer overflow on 32-bit clients, resulting in out-of-bounds writes that may lead to denial of service or remote code execution.

Recommendations Update FreeRDP to version 3.32.0 or later.