Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-121402

Freerdp: null pointer dereference can lead to denial of service

Risk score
42/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
3 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the clien…
Affected
Freerdp before 3.32.2
Fix
Upgrade Freerdp to 3.32.2 or later.
Exploitation
No known exploitation

Story map

Story map: FreerdpTHE FLAWSTHE FIXCVE-2026-121402Null pointer dereference canlead to denial of serviceCVSS 6.5 · EPSS 0%CVE-2026-109257Double free can lead to denialof serviceCVSS 7.5 · EPSS 0%CVE-2026-109676Use-after-free can lead todenial of serviceCVSS 8.8 · EPSS 0%CVE-2026-110838Missing authenticationCVSS 7.5 · EPSS 0%Upgrade Freerdp3.32.2 · 3.32.0or later on your release lineWho is exposedFreerdp before 3.32.0AMBER · PATCH THIS WEEKFreerdpFreeRDP before 3.32.0 containsa double-free vulnerability innsc_context_initialize_encode()that leaves dangling planepointers after a partial buffergrowth failure. Attackers usinga crafted RDP client can…Where it standsPublic proof of conceptCONNECTS TOSame weaknessNull pointer dereference (CWE-476)139 other warnings in 30 days →Same productEarlier Freerdp warnings84 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…

The flaws

  • CVE-2026-121402: Null pointer dereference can lead to denial of service (CVSS 6.5 · EPSS 0%)
  • CVE-2026-109257: Double free can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109676: Use-after-free can lead to denial of service (CVSS 8.8 · EPSS 0%)
  • CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.2 · 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.

Last activity 3 Nov 2026. Patch Forecast updates every hour.