CVE-2026-121952
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreeRDP before 3.32.2 has an out-of-bounds write in the proxy due to incorrect handling of bitmap cache v2 cell array, allowing a client to cause heap corruption, data leakage, or a crash.
- Affected
- {'product': 'FreeRDP', 'versions': 'before 3.32.2'}
- Fix
- Upgrade to version 3.32.2 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.
Last activity 4 Nov 2026. Patch Forecast updates every hour.