CVE-2026-121953
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreeRDP before 3.32.2 has a use-after-free vulnerability in the client's rdpgfx dynamic virtual channel, which can be exploited by a malicious RDP server to crash the client or potentially execute code.
- Affected
- {'products': ['FreeRDP'], 'packages': [], 'versions': ['before 3.32.2']}
- Fix
- Upgrade to version 3.32.2 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
Last activity 4 Nov 2026. Patch Forecast updates every hour.