Medium [CVE-2026-114041] Windows RD Gateway consent message heap out-of-bounds read
This medium-severity Red Hat Linux advisory covers CVE-2026-114041.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in FreeRDP. On Windows builds, client_cli_present_gateway_message passes a byte count as wide-character printf precision when printing RD Gateway consent or service messages.
A malicious RD Gateway can send crafted pre-authentication messages, causing the client to read beyond the buffer and potentially leak heap memory or crash. This issue affects FreeRDP before 3.32.1 on Windows.
This issue is rated Moderate because it can cause limited heap memory disclosure and/or a client crash (C:L/A:L) via a malicious RD Gateway without privileges. The vulnerable code path is compiled only for Windows builds (#if defined(WIN32)); the non-Windows branch correctly converts the wide-character length.
Red Hat Enterprise Linux and other Linux-based Red Hat products build FreeRDP for Linux and do not include this Windows-only code path, so they are not affected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
Weakness: CWE-125.
- < 3.32.1
Official advisory · high-confidence parse· fetched 34 minutes ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 34 minutes ago·verify at source
Mitigation checklist
- This issue affects Windows FreeRDP builds only; Red Hat Enterprise Linux FreeRDP packages are not affected. On Windows deployments, connect only to trusted RD Gateways and upgrade FreeRDP to 3.32.1 or later when available. Network controls that limit RD Gateway reachability reduce exposure ([CME-202](https://cmetaxonomy.org/entries/CME-202.html), [CME-203](https://cmetaxonomy.org/entries/CME-203.html)). No Red Hat product package update is required for this CVE.
Official advisory · high-confidence parse· fetched 34 minutes ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.