All vulnerabilities
CVE-2026-114041GHSA-c49c-xm94-5qf3

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP FreeRDP
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.32.1Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.

Text from CVE List

Affected versions 2

  • FreeRDPaffected: all versions before 3.32.1CVE List
  • FreeRDPunaffected: 3.32.1CVE List

References 2