FreeRDP CVE-2026-109255

Exploitation requires three concrete conditions drawn from the description: (1) the client must be a 32-bit FreeRDP build between 3.0.0 and 3.32.0 - the integer truncation does not trigger on 64-bit builds; (2) the victim must initiate an RDP connection to an attacker-controlled, malicious, or MITM'd server (UI:P / server-side attack, not a listening-service flaw); and (3) the attacker must deliver a crafted SERVER_LICENSE_REQUEST during license negotiation with a scopeCount large enough to overflow the truncated length check. No authentication is needed on the attacker side (PR:N), but the dependence on outbound user-initiated connection and on a 32-bit client are the primary limiting factors that constrain real-world exploitability.

This is a client-side vulnerability: a malicious or compromised RDP server attacks a FreeRDP client that connects to it, not the reverse. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H) is internally consistent with the description - no authentication (PR:N), but it requires user interaction to initiate a connection (UI:P) and carries an attack requirement (AT:P) that maps directly to the stated precondition that the client be a 32-bit build, since the integer truncation only manifests in 32-bit pointer/length arithmetic. The 6.1 (MEDIUM) score is driven by high integrity and availability impact with zero confidentiality impact (VC:N), matching a heap overflow that corrupts memory for code execution or crash but does not directly disclose data. Exploitation status is no public exploit identified at time of analysis - the CVE is not in CISA KEV and no POC is referenced, only a GHSA advisory and a VulnCheck write-up. There is no signal conflict between severity and exploitation here, but note the key limiting factors that keep real-world risk below the raw network-vector implication: it is reachable only when a user actively connects out to an attacker-controlled server AND runs a 32-bit FreeRDP build, which is increasingly uncommon on modern 64-bit deployments. No EPSS score was provided in the input, so exploitation probability cannot be quantified. Treat this as a moderate-priority patch for fleets that still ship 32-bit RDP clients or embed FreeRDP, rather than an emergency.

An attacker stands up a malicious RDP server (or compromises/MITMs a legitimate one) and lures a user running a 32-bit FreeRDP-based client to connect. During license negotiation the server returns a crafted SERVER_LICENSE_REQUEST with an oversized scopeCount; the truncated length check in license_check_stream_length passes, and the client writes attacker-controlled data past a heap buffer, enabling a crash (DoS) or potential remote code execution in the client process. No public exploit code is currently identified, and success depends on the victim initiating the outbound connection.