Description
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.
Published: 2026-10-13
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Heap out-of-bounds read leading to client crash
Action: Apply Update
AI Analysis

Impact

FreeRDP versions 3.0.0 through 3.31.x contain a heap out‑of‑bounds read that occurs when an attacker‑controlled RD Gateway sends messages whose declared length (MsgBytes) exceeds the actual data size (ActualCount) in consent or service messages. The resulting UTF‑8 conversion reads beyond the allocated buffer, causing the client to crash and become unavailable, which constitutes a denial‑of‑service condition for users connecting through that gateway.

Affected Systems

All FreeRDP clients distributed as part of the 3.0.0 to 3.31.x series are vulnerable. The issue is present in the core FreeRDP library and affects any installation that relies on those versions, whether it is a client on Windows, Linux, or macOS that is used to connect through an RD Gateway.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity; the vulnerability does not provide remote code execution or data theft, but it allows an attacker who controls or can influence the RD Gateway to make target clients crash. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, yet the ease of triggering a DoS by manipulating gateway messages means it should be addressed promptly, especially in environments where RD Gateway traffic cannot be fully trusted.

Generated by OpenCVE AI on October 13, 2026 at 15:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.32.0 or newer.
  • Restrict RD Gateway access to trusted networks or administrators until the update can be applied.
  • Monitor client stability for any crashes after deployment of the patched version.

Generated by OpenCVE AI on October 13, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.
Title FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-125
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T13:47:09.491Z

Reserved: 2026-10-13T11:25:25.213Z

Link: CVE-2026-109950

cve-icon Vulnrichment

Updated: 2026-10-13T13:47:04.362Z

cve-icon NVD

Status : Received

Published: 2026-10-13T14:17:33.563

Modified: 2026-10-13T14:17:33.563

Link: CVE-2026-109950

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T15:30:08Z

Weaknesses