CVE-2026-114041

A flaw was found in FreeRDP. On Windows builds, client_cli_present_gateway_message passes a byte count as wide-character printf precision when printing RD Gateway consent or service messages. A malicious RD Gateway can send crafted pre-authentication messages, causing the client to read beyond the buffer and potentially leak heap memory or crash. This issue affects FreeRDP before 3.32.1 on Windows.

This issue is rated Moderate because it can cause limited heap memory disclosure and/or a client crash (C:L/A:L) via a malicious RD Gateway without privileges. The vulnerable code path is compiled only for Windows builds (#if defined(WIN32)); the non-Windows branch correctly converts the wide-character length. Red Hat Enterprise Linux and other Linux-based Red Hat products build FreeRDP for Linux and do not include this Windows-only code path, so they are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.