CVE-2026-121964
Freerdp: heap buffer overflow can lead to remote code execution
- Risk score
- 55/100
- CVSS
- 7.5 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compr…
- Affected
- Freerdp before 3.32.2
- Fix
- Upgrade Freerdp to 3.32.2 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…
The flaws
- CVE-2026-121964: Heap buffer overflow can lead to remote code execution (CVSS 7.5)
- CVE-2026-109257: Double free can lead to denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-109676: Use-after-free can lead to denial of service (CVSS 8.8 · EPSS 0%)
- CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)
The fix
Upgrade Freerdp: 3.32.2 · 3.32.0 or later on your release line
Who is exposed: Freerdp before 3.32.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 400 other warnings in 30 days
- Same product: Earlier Freerdp warnings. 84 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
References
Original description
FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution.
Last activity 4 Nov 2026. Patch Forecast updates every hour.