Heap Out-of-Bounds Read in FreeRDP Windows Client

Executive Summary

CVE-2026-114041 is a heap out-of-bounds read vulnerability in FreeRDP versions before 3.32.1 on Windows. A malicious RD Gateway can send pre-authentication consent or service messages that cause the client to read twice the intended buffer size. This leads to heap memory leaks or crashes due to incorrect handling of byte counts in wide-character printf precision.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system. Run: freerdp /v:localhost /cert-ignore. If the version is below 3.32.1, the system is vulnerable. Monitor network traffic for RD Gateway consent or service messages from untrusted sources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause FreeRDP clients to crash or leak sensitive heap memory. Since it occurs during pre-authentication via RD Gateway messages, attackers could exploit it remotely without user interaction. The impact includes denial of service or potential information disclosure from leaked memory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through heap memory leaks or causing service disruptions via crashes. A malicious RD Gateway could exploit this to leak memory containing user or session data, which may violate confidentiality requirements under these regulations. The out-of-bounds read occurs pre-authentication, meaning unauthorized access to sensitive information is possible before any security checks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.1 or later. Block untrusted RD Gateway connections at the network perimeter. Disable pre-authentication consent messages if not required. Monitor for crashes or memory leaks in FreeRDP clients.

Useful 0 Not Useful 0