FreeRDP CVE-2026-109249

Exploitation requires the victim to open an attacker-supplied Windows Remote Assistance invitation file (.msrcIncident) in the FreeRDP client (xfreerdp), along with the accompanying password that decrypts the ConnectionString2 blob parsed by freerdp_assistance_parse_all_elements_of(). Limiting factors: this is a local, file-parsing attack (AV:L) that triggers before any RDP connection is made, so it cannot be reached by merely connecting to a server; it depends on social engineering the user into opening the crafted invitation (UI required); and affected builds are FreeRDP 3.0.0 through before 3.32.0. The impact is a client crash (denial of service) only.

This is a client-side denial-of-service issue with a deliberately modest real-world priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VA:H with VC:N and VI:N) scores 6.8 (Medium) and is internally consistent with the description: exploitation is local, requires the victim to open an attacker-supplied file, and yields only an availability impact (a crash of xfreerdp), with no confidentiality or integrity impact. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so per the precision rules this is 'no public exploit identified at time of analysis.' The source-code evidence (the patch adds a 'vlen > len' bounds check before strnlen and shrinks the scan window) confirms the root cause is a bounded heap over-read that advances the cursor without reducing remaining length - the kind of bug that reliably crashes rather than leaks or executes code. Signals are coherent, not conflicting, with one caveat: the 'Information Disclosure' tag overstates impact, since CVSS VC:N and the description (crash only, before any RDP connection) indicate availability-only impact. CWE-125 (out-of-bounds read) can in principle leak adjacent heap memory, but there is no evidence here that read data is returned to an attacker, and the vendor-rated VC:N argues against practical disclosure. Net: a legitimate bug worth patching on the normal cycle, but not an emergency given local vector, required user interaction, and no exploitation/POC signals.

An attacker crafts a malicious Windows Remote Assistance invitation (.msrcIncident file) together with a matching password and delivers it to a victim via email or a shared link. When the victim opens the file with xfreerdp, the parser scans past the end of the decrypted ConnectionString2 buffer and the client crashes before any RDP connection is established. No public exploit code was identified at time of analysis, and the outcome is a crash (denial of service), not code execution.