CVE-2026-109680

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.18.0 through 3.31.0

Description A heap-based out-of-bounds write occurs in the freerdp interruptible get line() function. The issue arises when the buffer is reduced to 32 bytes while maintaining the length of a pre-filled suggested username as the write offset. A compromised or malicious ARM routing service can provide a long redirectedUsername that reaches the CLI credential prompt, leading to a client crash when the user provides input.

Recommendations Update FreeRDP to version 3.32.0 or later.