CVE-2026-114041

EUVD-2026-106992
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.07%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
freerdpfreerdp
𝑥
< 3.32.1
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c49c-xm94-5qf3
https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-out-of-bounds-read-via-rd-gateway-consent-message