HIGH 8.7 NVD
CVE-2026-121957
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics hand
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g
- https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-reset
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-04 via NVD.
vulnfeed aggregates 18258 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.