CVE-2026-114044: FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFXMAPSURFACETOWINDOWPDU with oversized dimensions, causing androidUpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP Android Clientto a version that resolves this vulnerability.Fixed in 3.32.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Only the FreeRDP Android client is identified as affected. The issue applies to versions before 3.32.1 when the client processes graphics data from an RDP server.
What does an attacker need to exploit this?
An attacker needs to operate or control a malicious RDP server that the Android client connects to. The server can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU containing oversized mappedWidth and mappedHeight values; no client-side privileges or user interaction beyond connecting are indicated.
What is the impact of successful exploitation?
The out-of-bounds read can cause the Android client to crash or disclose heap memory beyond a surface-buffer allocation. The supplied severity vector indicates low confidentiality impact and no integrity or availability impact.
How can I remediate the issue?
Upgrade the FreeRDP Android client to version 3.32.1 or later. If upgrading is not immediately possible, avoid connecting the affected client to untrusted or attacker-controlled RDP servers.