Live › vulnerability › CVE-2026-114044
Go to dashboardFreeRDP before 3.32.1 Android client trusts mappedWidth and mappedHeight values from an RDP server without validation. A malicious server can send an oversized RDPGFX_MAP_SURFACE_TO_WINDOW_PDU, causing the client to copy heap memory past its buffer, leading to crashes or memory disclosure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that ship or use the FreeRDP Android client to connect to RDP servers. The flaw is triggered by a malicious or compromised RDP server, so exposure depends on whether users connect to untrusted servers. Desktop-only deployments and users who only connect to trusted servers are less exposed.
No product ranges from the sources yet.
xfreerdp /version or the app's about screen; affected builds are before 3.32.1.3.32.1 or later and rebuild or update the Android client.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions, causing android_UpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-114044")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.