Live › vulnerability › CVE-2026-114041
Go to dashboardFreeRDP before 3.32.1 on Windows reads past a heap buffer in client_cli_present_gateway_message because a byte count is passed as a wide-character printf precision. A malicious RD Gateway can send crafted consent or service messages to make the client read about twice the buffer size, leaking heap memory or crashing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Windows clients built on FreeRDP before that connect through an RD Gateway, which is the path that delivers the attacker-controlled messages. Teams that only run FreeRDP on Linux or macOS, or that do not use RD Gateway, are not described as exposed by the sources. Vendors who ship FreeRDP inside their own Windows client should check their bundled version.
3.32.1No product ranges from the sources yet.
xfreerdp /version or check the installed FreeRDP version on Windows clients; the sources do not give a shell command for every install path3.32.13.32.1 or later on Windows clientsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.
This page as .md · .json · in your agent: get_signal("CVE-2026-114041")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.