CVE-2026-109950: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which clients are exposed to this issue?
FreeRDP clients running versions from 3.0.0 up to, but not including, 3.32.0 are affected when they process consent or service messages from an RD Gateway.
What must an attacker control to trigger the crash?
The attacker must control the RD Gateway used by the client. They can send consent or service messages with a MsgBytes value much larger than the NDR string ActualCount, causing an out-of-bounds read during UTF-8 conversion.
What is the practical impact of successful exploitation?
Successful exploitation can disrupt client availability by crashing the FreeRDP client. The provided information does not indicate confidentiality or integrity impact.