CVE-2026-114044
Description
A flaw was found in FreeRDP. The Android client does not validate mappedWidth and mappedHeight from RDPGFX_MAP_SURFACE_TO_WINDOW_PDU against the surface buffer. A malicious RDP server can cause android_UpdateWindowFromSurface to read beyond the allocation, leading to crashes or memory disclosure. This issue affects FreeRDP before 3.32.1 in the Android client only.
Statement
This issue is rated Moderate because a malicious RDP server can cause limited confidentiality impact (C:L) through an out-of-bounds read in the Android FreeRDP client graphics pipeline. The vulnerable code is specific to the Android client (aFreeRDP) and is not part of the Linux desktop FreeRDP packages. Red Hat Enterprise Linux and other Red Hat products that ship the Linux FreeRDP client/libraries do not include the Android client code path and are not affected.
Mitigation
This issue affects the FreeRDP Android client only; Red Hat Enterprise Linux FreeRDP packages are not affected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat CVSS v3 Score Explanation
RH tracks CNA vector for Android FreeRDP client. AV:N — malicious RDP server. AC:L/PR:N/UI:N. C:L — limited OOB read disclosure. Score 5.3 Moderate. Red Hat products ship Linux FreeRDP, not the Android client, so all RH affects are Not Affected; scoring documents upstream severity only.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
