FreeRDP CVE-2026-109680

Exploitation requires the attacker to control or compromise the ARM routing service (RDP gateway redirection service) in the client's connection path, which then returns a maliciously long redirectedUsername; this is the AT:P attack requirement. The long username must pre-fill the FreeRDP CLI credential prompt, and the crash only triggers when the victim actively types input at that prompt (the UI:P user-interaction requirement). Limiting factors: the attacker cannot exploit this against a client that connects only to trusted, uncompromised ARM/gateway infrastructure; exploitation is confined to CLI usage where the suggested username reaches freerdp_interruptible_get_line; and affected deployments are restricted to FreeRDP versions 3.18.0 through 3.31.x (fixed in 3.32.0). The outcome is limited to a client-side crash, not privilege gain or data exposure.

This is a moderate-severity denial-of-service issue, not a high-priority remote code execution threat despite the CWE-787 (out-of-bounds write) classification. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H) tells the real story: the only impact is to availability (VA:H), with confidentiality and integrity explicitly set to none (VC:N/VI:N), meaning the heap OOB write results in a client crash rather than code execution or data compromise. The base score of 6.0 is driven entirely by the crash impact. Critically, exploitation is gated by two non-trivial preconditions encoded in the vector: AT:P (a specific attack requirement - the attacker must control or compromise the ARM routing service in the connection path) and UI:P (the victim must interact by typing at the CLI credential prompt). No EPSS score, KEV listing, or POC was provided in the input. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. The combination of attacker-controlled-infrastructure dependency plus required user interaction, for an availability-only outcome, makes this a low-to-moderate real-world priority: patch in the normal cycle rather than as an emergency. Note that the memory-corruption primitive (controlling a write offset past a shrunk 32-byte buffer) could in theory be more serious, but the authoritative vendor/NVD impact metrics score it as availability-only, so this analysis treats it as a crash.

An attacker who controls or has compromised the ARM (gateway) routing service that a FreeRDP client contacts returns an overly long redirectedUsername value. This suggested username pre-fills the CLI credential prompt, and because the input buffer is shrunk to 32 bytes while retaining the long username's length as the write offset, the client writes out of bounds and crashes the moment the victim types input at the prompt. No public exploit code was identified in the provided data.