CVE-2026-114041: FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Windows systems running FreeRDP versions earlier than 3.32.1 are affected when they connect to an RD Gateway that can send consent or service messages.
What must an attacker control to exploit it?
An attacker needs to operate or control a malicious RD Gateway. The gateway can trigger the issue by sending a pre-authentication consent or service message; no client authentication or user interaction is required.
What is the likely impact on an affected client?
The client may read beyond a heap buffer, which can disclose heap memory or cause the FreeRDP client to crash.