{"id":"CVE-2026-121408","kind":"vulnerability","aliases":["CVE-2026-121408"],"related":[],"title":"FreeRDP: USB redirection flaw lets a malicious server crash the client","description":"FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.","summary":"FreeRDP before 3.32.2 has a use-after-free in its urbdrc USB redirection channel, where a channel is freed while another thread still uses it. A malicious RDP server can trigger this during USB device announcement, crashing the client.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","remote-desktop","runtime","windows"],"not_affected_if":["trusted-servers-only","usb-redirection-disabled"],"how_to_check":"- Check the FreeRDP version with `xfreerdp --version` or the package manager, and compare against `3.32.2`\n- Confirm whether USB device redirection (urbdrc) is enabled in the client configuration: unknown","fix":"- Move FreeRDP to `3.32.2` or later","status":"open","published_at":"2026-11-03T15:17:29+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","triaged_at":"2026-11-03T15:23:20+00:00","updated_at":"2026-11-03T15:23:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T15:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- Move FreeRDP to `3.32.2` or later","reach":"network","title":"FreeRDP: USB redirection flaw lets a malicious server crash the client","impact":"low","summary":"FreeRDP before 3.32.2 has a use-after-free in its urbdrc USB redirection channel, where a channel is freed while another thread still uses it. A malicious RDP server can trigger this during USB device announcement, crashing the client.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freerdp","remote-desktop","linux","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"client crashes; memory corruption may be possible","analyst_note":"","how_to_check":"- Check the FreeRDP version with `xfreerdp --version` or the package manager, and compare against `3.32.2`\n- Confirm whether USB device redirection (urbdrc) is enabled in the client configuration: unknown","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-servers-only","usb-redirection-disabled"],"who_is_affected":"Teams that run FreeRDP clients to connect to remote desktops, particularly where USB redirection is used. The flaw is triggered by a malicious RDP server, so clients that only connect to trusted servers are at lower risk. Whether the default configuration enables urbdrc is unknown from the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4211,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121408':14A,17A '-2026':13A,16A '3.32.2':27B,67C 'announc':61B,120C,129C 'anoth':46B 'channel':39B,42B,79C,84C,93C,114C,126C,132C 'client':11A,64B,119C,137C 'close':94C,115C 'contain':68C 'control':92C,113C 'control-channel':91C,112C 'crash':9A,62B,135C 'cve':12A,15A 'desktop':22B 'devic':60B,100C,123C 'findchannelbyid':81C 'flaw':4A 'free':33B,73C,124C 'freed':44B 'freerdp':1A,18B,25B,65C 'let':5A 'linux':19B 'load':103C 'lock':104C 'malici':7A,52B,106C 'manag':101C 'path':95C 'pointer':85C 'rdp':53B,107C 'read':131C 'redirect':3A,38B,78C 'refer':88C 'remot':21B 'remote-desktop':20B 'request':116C 'return':82C 'runtim':23B 'send':110C 'server':8A,54B,108C 'still':48B 'take':98C 'thread':47B,130C 'trigger':56B 'urbdrc':36B,76C 'usb':2A,37B,59B,77C,122C 'use':31B,49B,71C 'use-after-fre':30B,70C 'window':24B 'without':86C 'write':133C","nicknames":[],"mitigations":[],"who_affected":"Teams that run FreeRDP clients to connect to remote desktops, particularly where USB redirection is used. The flaw is triggered by a malicious RDP server, so clients that only connect to trusted servers are at lower risk. Whether the default configuration enables urbdrc is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","linux","medium","remotedesktop","runtime","windows"],"first_public_at":"2026-10-19T12:08:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121408","severity":null,"published_at":"2026-11-03T15:17:29+00:00","modified_at":"2026-11-03T15:17:29+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","fetched_at":"2026-11-03T15:21:58+00:00","note":null}],"documents":[{"id":58339,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w897-ffhv-5j7g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:08:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58340,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-usb-redirection-control-channel","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}