CVE-2026-114044

A flaw was found in FreeRDP. The Android client does not validate mappedWidth and mappedHeight from RDPGFX_MAP_SURFACE_TO_WINDOW_PDU against the surface buffer. A malicious RDP server can cause android_UpdateWindowFromSurface to read beyond the allocation, leading to crashes or memory disclosure. This issue affects FreeRDP before 3.32.1 in the Android client only.

This issue is rated Moderate because a malicious RDP server can cause limited confidentiality impact (C:L) through an out-of-bounds read in the Android FreeRDP client graphics pipeline. The vulnerable code is specific to the Android client (aFreeRDP) and is not part of the Linux desktop FreeRDP packages. Red Hat Enterprise Linux and other Red Hat products that ship the Linux FreeRDP client/libraries do not include the Android client code path and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.