CVE-2026-114041
Description
A flaw was found in FreeRDP. On Windows builds, client_cli_present_gateway_message passes a byte count as wide-character printf precision when printing RD Gateway consent or service messages. A malicious RD Gateway can send crafted pre-authentication messages, causing the client to read beyond the buffer and potentially leak heap memory or crash. This issue affects FreeRDP before 3.32.1 on Windows.
Statement
This issue is rated Moderate because it can cause limited heap memory disclosure and/or a client crash (C:L/A:L) via a malicious RD Gateway without privileges. The vulnerable code path is compiled only for Windows builds (#if defined(WIN32)); the non-Windows branch correctly converts the wide-character length. Red Hat Enterprise Linux and other Linux-based Red Hat products build FreeRDP for Linux and do not include this Windows-only code path, so they are not affected.
Mitigation
This issue affects Windows FreeRDP builds only; Red Hat Enterprise Linux FreeRDP packages are not affected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Red Hat CVSS v3 Score Explanation
RH tracks CNA vector for Windows FreeRDP. AV:N — malicious RD Gateway pre-auth. AC:L/PR:N/UI:N — no privileges or interaction. C:L/A:L — limited disclosure and/or crash. Score 6.5 Moderate. Red Hat Linux products are Not Affected (Windows-only #if WIN32 path); scoring documents upstream severity only.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
