CVE-2026-109680

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername th...

CVE-2026-109680

FreeRDP versions 3.18.0 before 3.32.0 are vulnerable to a heap-based out-of-bounds write within the freerdp_interruptible_get_line function. The flaw occurs because the buffer is shrunk to 32 bytes while retaining a pre-filled suggested username's length as the write offset. A malicious or compro...