CVE-2026-114041 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP deployments should assess exposure and prioritize patching to prevent potential heap memory leaks or client crashes. This includes verifying FreeRDP versions, applying patches, and monitoring for potential heap memory leaks or client crashes. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close

Why it matters

Defenders should prioritize verifying FreeRDP versions and applying patches to prevent potential heap memory leaks or client crashes.

• Potential heap memory leaks or client crashes
• Verification of FreeRDP versions and patches required
• Monitoring for malicious RD Gateway activity recommended

Technical summary

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. This vulnerability can be triggered by a malicious RD Gateway sending pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing. The vulnerability highlights the need for careful input validation and patching to prevent exploitation. Defenders should prioritize verifying FreeRDP versions and applying patches to prevent potential heap memory leaks or client crashes.

Defensive priority

Defenders should prioritize verifying FreeRDP versions and applying patches to prevent potential heap memory leaks or client crashes.

Recommended defensive actions

• Verify FreeRDP versions and apply patches
• Monitor for potential heap memory leaks or client crashes
• Implement compensating controls to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the heap out-of-bounds read vulnerability in FreeRDP before 3.32.1. The vulnerability is caused by improper handling of a byte count as wide-character printf precision in client_cli_present_gateway_message. Defenders should verify FreeRDP versions and apply patches to prevent potential heap memory leaks or client crashes. Evidence is limited to CVE Program and NVD records, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.