CVE-2026-109950

4.3Medium

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-125

Impact

A malicious RD Gateway can crash client sessions and cause denial of service. The attacker needs control of the RD Gateway that a user connects through.

Root cause

A heap out-of-bounds read occurs during UTF-8 conversion when the gateway sends mismatched MsgBytes and NDR string ActualCount lengths in consent or service messages.

Affected systems

FreeRDP 3.0.0 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later; if patching must wait, avoid routing connections through untrusted RD Gateways.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109950