CVE-2026-121950 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP clients fail to validate the product of surface width and height when handling an RDPGFX CREATE_SURFACE message. A malicious RDP server can send a crafted message that causes a heap overflow on 32-bit builds or a roughly 4 GiB allocation on 64-bit builds, leading to memory corruption or denial of service.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only FreeRDP clients connecting to RDP servers can be exposed, and the risk comes from the server being malicious or impersonated. Teams that only run FreeRDP servers or use other RDP clients can skip it. Applications that embed FreeRDP as a library are affected through that library version.
Not affected if no-rdp-client, rdpgfx-disabled
Who cares freerdp, rdp, remote-desktop
xfreerdp --version or the package manager, and compare it to the fixed range below.3.32.2 or later.FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE_SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-121950") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.