CVE-2026-121954 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeRDP before 3.32.2 commits new image dimensions in its planar codec before buffer reallocation succeeds, so a failed reset leaves a heap out-of-bounds write reachable. A malicious RDP server can send an oversized ResetGraphics message followed by a GFX PLANAR command to corrupt client heap memory and crash the client.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any application or remote desktop client built on FreeRDP that connects to RDP servers, especially servers you do not control, is exposed. The flaw sits in the planar graphics codec, so a client that only talks to trusted servers carries lower risk. The sources do not say whether memory corruption can go beyond a client crash.
Not affected if fixed-version, trusted-servers-only
Who cares freerdp, linux, rdp, remote-desktop, windows
xfreerdp --version or the version in the packaged library.3.32.2.3.32.2 or later.FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR command, to corrupt client heap memory and crash the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-121954") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.