FreeRDP CVE-2026-109950

Exploitation requires the attacker to control the RD Gateway (malicious or compromised) that a FreeRDP client (versions 3.0.0 up to but not including 3.32.0) connects through, and the victim client must actively initiate an RDP session via that gateway (UI:P). The specific trigger is a consent or service message in which the MsgBytes value is set far larger than the NDR string ActualCount, causing UTF-8 conversion to read past the stream allocation. Limiting factors: it is a client-side flaw (not exploitable against a server), it requires attacker control of the gateway plus the victim electing to connect through it, and the only outcome is a client-process crash (no code execution or data exposure).

This is a genuinely medium/low-priority issue rather than an urgent one, and the signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 5.3 and shows the only impact is a limited availability loss (VA:L) - a client crash - with no confidentiality or integrity impact and no scope change. Critically, exploitation requires an attacker to already control the RD Gateway the victim connects to, and requires passive user interaction (UI:P), i.e. the client voluntarily establishing an RDP session through the malicious gateway. This substantially narrows the realistic attacker population versus a server-side or fully unauthenticated-network flaw. No EPSS score, no POC, and no CISA KEV listing were provided in the input, and no public exploit is identified. The attack is a denial-of-service (client crash) only - there is no evidence of memory disclosure to the attacker or code execution despite the 'Information Disclosure' tag. Overall: a real but low-urgency availability bug; patch in normal cycles rather than as an emergency.

An attacker who operates or has compromised an RD Gateway lures or coerces a FreeRDP-based client into connecting through it (UI:P). During the gateway handshake the attacker returns a consent or service message whose MsgBytes field is set far larger than the NDR string ActualCount, so the client's UTF-8 conversion reads past the end of the stream allocation and crashes. No public exploit code was identified at time of analysis; impact is limited to disrupting the victim client's availability.