CVE-2026-114041: FreeRDP Buffer Overflow Vulnerability

CVE-2026-114041 Overview

CVE-2026-114041 is a heap out-of-bounds read vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw affects FreeRDP versions prior to 3.32.1 running on Windows. The defect resides in client_cli_present_gateway_message, which passes a byte count as a wide-character printf precision specifier. A malicious Remote Desktop (RD) Gateway can deliver pre-authentication consent or service messages that cause the FreeRDP client to read beyond the allocated buffer, leaking adjacent heap memory or crashing the client process. The issue is categorized under CWE-125 (Out-of-Bounds Read).

Critical Impact
An attacker-controlled RD Gateway can trigger a pre-authentication heap read of twice the intended buffer size in FreeRDP on Windows, exposing heap contents or crashing the client.

Affected Products

FreeRDP versions prior to 3.32.1 on Windows
FreeRDP command-line client (xfreerdp/wfreerdp) components invoking client_cli_present_gateway_message
Applications and distributions embedding affected FreeRDP builds for RD Gateway connectivity

Discovery Timeline

2026-10-21 - CVE-2026-114041 published to the National Vulnerability Database (NVD)
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114041

Vulnerability Analysis

The vulnerability is a heap out-of-bounds read triggered during the handling of RD Gateway messages. FreeRDP's client_cli_present_gateway_message function formats a server-supplied message for display to the user. The function uses a wide-character printf-family call where the precision parameter should express the number of wide characters to print. The code supplies a byte count instead. Because each wchar_t on Windows is two bytes wide, the precision value instructs the formatter to read twice the number of bytes actually present in the buffer. The reader walks past the end of the heap allocation, dereferencing adjacent memory until the specified count is reached. The read can disclose heap contents through the printed output or crash the client when it reaches an unmapped page.

Root Cause

The defect is a size-unit mismatch between bytes and wide characters. The caller measures the buffer in bytes and passes that measurement to a formatting routine that interprets the value as a wchar_t count. No bounds check reconciles the two units before the formatter dereferences the buffer. The result is a deterministic read of 2 * buffer_size bytes from a heap allocation sized to hold only buffer_size bytes.

Attack Vector

Exploitation requires the victim to connect through an attacker-controlled or compromised RD Gateway. The malicious gateway sends a crafted consent or service message during the pre-authentication phase of the RDP handshake. No user credentials or interaction with the gateway's authentication prompts are required for the vulnerable path to execute. The attacker observes leaked heap data through the client's message display or forces a denial of service by provoking a crash on inaccessible memory.

No verified public proof-of-concept code is available. Technical details are documented in the FreeRDP GitHub Security Advisory GHSA-c49c-xm94-5qf3 and the VulnCheck advisory.

Detection Methods for CVE-2026-114041

Indicators of Compromise

Unexpected crashes of FreeRDP client processes (wfreerdp.exe, xfreerdp) shortly after initiating an RD Gateway connection
Outbound RD Gateway sessions to hosts outside the organization's approved gateway inventory
RDP client log entries referencing gateway consent or service message handling followed by abnormal termination

Detection Strategies

Inventory endpoints for FreeRDP installations and flag any binary with a version string earlier than 3.32.1
Correlate FreeRDP process crashes with preceding TCP sessions to RD Gateway endpoints on port 443
Alert on FreeRDP clients negotiating RD Gateway sessions with destinations that are not in a sanctioned allowlist

Monitoring Recommendations

Capture Windows Error Reporting and application crash telemetry for FreeRDP binaries and route it to centralized logging
Monitor egress TLS flows to untrusted RD Gateway hosts, which typically present as HTTPS to /remoteDesktopGateway/
Review endpoint detection and response telemetry for FreeRDP child process behavior and abnormal memory access patterns

How to Mitigate CVE-2026-114041

Immediate Actions Required

Upgrade all FreeRDP installations on Windows to version 3.32.1 or later
Restrict outbound RDP and RD Gateway traffic to a vetted list of corporate gateways
Audit third-party applications that bundle FreeRDP and apply vendor updates once rebuilt packages are available

Patch Information

The FreeRDP project resolved the issue in version 3.32.1. The fix corrects the precision argument passed to the wide-character formatter in client_cli_present_gateway_message so that it reflects the number of wchar_t units rather than the byte length of the buffer. Release details and patch references are published in the FreeRDP GitHub Security Advisory.

Workarounds

Avoid connecting to RD Gateways that are not under organizational control until clients are patched
Block FreeRDP on Windows endpoints from reaching external RD Gateway hosts using host firewall policies
Use a native Microsoft RDP client for gateway-brokered sessions while FreeRDP updates are being deployed

bash

# Verify installed FreeRDP version on Windows (PowerShell)
(Get-Item "C:\Program Files\FreeRDP\wfreerdp.exe").VersionInfo.ProductVersion

# Example host firewall rule to restrict wfreerdp.exe to approved RD Gateway
New-NetFirewallRule -DisplayName "Block wfreerdp to untrusted gateways" `
  -Program "C:\Program Files\FreeRDP\wfreerdp.exe" `
  -Direction Outbound -Action Block `
  -RemoteAddress Any