CVE-2026-121953 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP's client has a use-after-free in its rdpgfx dynamic virtual channel: a duplicate-name channel overwrites a callback that is freed without being cleared. A malicious RDP server can trigger a crash of the client or potentially execute code on it.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams whose software embeds or uses the FreeRDP client to connect to RDP servers are exposed, since the flaw is in the client and is triggered by a hostile server it connects to. Systems that only run the FreeRDP server side or never connect to untrusted RDP hosts can likely skip it, though the sources do not say this explicitly.
Not affected if no-untrusted-rdp-hosts, server-only-use
Who cares freerdp, rdp, remote-desktop
xfreerdp --version, and compare it with the fixed release below.3.32.2 or later.FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-121953") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.