Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

FreeRDP on Debian may crash or be taken over

CVE-2026-109255 · published 3 days ago
Summary

The FreeRDP client included in Debian's freerdp2 and freerdp3 packages can be fooled by a malicious remote desktop server into writing data beyond its memory limits. This can cause the client to stop working or allow the attacker to run their own code on the user’s computer. Update the FreeRDP packages to version 3.32 or later, or apply any security patches released by Debian.

What to do
  • Update debian freerdp3 to version 3.32.0+dfsg-1.
  • Update freerdp freerdp to version 3.32.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian freerdp2 All versions
Debian:13 debian freerdp3 All versions
Debian:14 debian freerdp3 < 3.32.0+dfsg-1
Fix: upgrade to 3.32.0+dfsg-1
– freerdp freerdp < 3.32.0
Original advisory text
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published12 Oct 2026
Updated15 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109255 · NVD
DEBIAN-CVE-2026-109255 · OSV
CVE-2026-109255 · OSV
GHSA-hxw3-57rq-3v4m · GHSA
CVE-2026-109255 · MITRE
Track software like this
Free during beta