Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-114041— FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

Quick assessment

Affected

FreeRDP FreeRDP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Windows 平台上，3.32.1 之前的 FreeRDP 版本在函数中存在堆越界读取漏洞。该函数将字节数作为宽字符的精度参数传递。恶意的 RD Gateway 可发送预认证同意或服务消息，导致客户端读取超出缓冲区两倍大小的数据，从而引发堆内存泄露或程序崩溃。

CVSS 6.5 · Medium Updated Oct 21, 2026

Possible ATT&CK Techniques 2 AI

T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

Source: CVE Program / CVE List V5

Vulnerability Description

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FreeRDP	FreeRDP	0 ~ 3.32.1	-

II. Public POCs for CVE-2026-114041

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114041

请登录查看更多情报信息。

Other References for CVE-2026-114041 (2)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c49c-xm94-5qf3 vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-out-of-bounds-read-via-rd-gateway-consent-message third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-114041

Same Patch Batch · FreeRDP · 2026-10-21 · 7 CVEs total

CVE-2026-114045	8.8 HIGH	FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
CVE-2026-114047	6.8 MEDIUM	FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation
CVE-2026-114046	6.5 MEDIUM	FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
CVE-2026-114043	6.5 MEDIUM	Vulnerability in FreeRDP
CVE-2026-114042	6.5 MEDIUM	FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
CVE-2026-114044	5.3 MEDIUM	FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

IV. Related Vulnerabilities

Same product: FreeRDP

Same vendor: FreeRDP

Same weakness: CWE-125

V. Comments for CVE-2026-114041

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-114041— FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

Quick assessment

Possible ATT&CK Techniques 2 AI

I. Basic Information for CVE-2026-114041

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-114041

III. Intelligence Information for CVE-2026-114041

Other References for CVE-2026-114041 (2)

Same Patch Batch · FreeRDP · 2026-10-21 · 7 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-114041

Leave a comment