FreeRDP EUVD-2026-106992

A FreeRDP client on Windows at a version before 3.32.1 must initiate a connection through an RD Gateway that is attacker-controlled, compromised, or man-in-the-middle'd; the gateway then sends crafted pre-authentication consent or service messages that are processed by client_cli_present_gateway_message. No attacker authentication is required (PR:N) and no special client configuration beyond using gateway mode. LIMITING FACTORS: the client must be lured or network-redirected to the malicious gateway (not a server-side, internet-scannable exposure), the flaw is Windows-specific, and the impact is limited to heap memory disclosure or a client crash - no code execution or data integrity impact.

This is a moderate-severity, client-side information-disclosure/DoS flaw (CWE-125 heap out-of-bounds read) in FreeRDP's RD Gateway message handling. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L) scores 6.9 and implies network, low-complexity, unauthenticated exploitation with low confidentiality and availability impact and no integrity impact - consistent with a memory leak plus crash. However, the vector's UI:N is questionable: the description's threat model is a MALICIOUS RD Gateway, meaning the victim client must first initiate a connection through the attacker-controlled (or MITM'd) gateway, which is effectively a required user/connection action - verify UI with the vendor advisory. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the provided data, so this is no public exploit identified at time of analysis. Net: a real but lower-tier priority - the impact is bounded (heap info leak or crash, not RCE, no integrity impact), and exploitation depends on steering a victim to a hostile gateway rather than broad internet-facing exposure. Patch opportunistically; it is not an emergency on the signals available.

An attacker stands up or compromises an RD Gateway (or performs a man-in-the-middle on a gateway connection) and waits for a FreeRDP client on Windows (before 3.32.1) to connect. Before authentication, the gateway returns a crafted consent or service message whose byte count is misused as a wide-character printf precision, causing the client to read roughly twice the buffer size and leak adjacent heap memory or crash. No public exploit code was identified in the provided data; exploitation requires network vector with low complexity but hinges on the victim connecting to the hostile gateway.