Live › vulnerability › CVE-2026-121408
FreeRDP before 3.32.2 has a use-after-free in its urbdrc USB redirection channel, where a channel is freed while another thread still uses it. A malicious RDP server can trigger this during USB device announcement, crashing the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams that run FreeRDP clients to connect to remote desktops, particularly where USB redirection is used. The flaw is triggered by a malicious RDP server, so clients that only connect to trusted servers are at lower risk. Whether the default configuration enables urbdrc is unknown from the sources.
No product ranges from the sources yet.
xfreerdp --version or the package manager, and compare against 3.32.23.32.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-121408")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.