{"id":"CVE-2026-121954","kind":"vulnerability","aliases":["CVE-2026-121954"],"related":[],"title":"FreeRDP: malicious RDP server can corrupt client memory and crash it","description":"FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR command, to corrupt client heap memory and crash the client.","summary":"FreeRDP before 3.32.2 commits new image dimensions in its planar codec before buffer reallocation succeeds, so a failed reset leaves a heap out-of-bounds write reachable. A malicious RDP server can send an oversized ResetGraphics message followed by a GFX PLANAR command to corrupt client heap memory and crash the client.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","rdp","remote-desktop","runtime","windows"],"not_affected_if":["fixed-version","trusted-servers-only"],"how_to_check":"- Check the FreeRDP version the client uses: `xfreerdp --version` or the version in the packaged library.\n- Look for any build or package using FreeRDP below `3.32.2`.\n- Note whether the client connects to RDP servers you do not control.","fix":"- FreeRDP: move to `3.32.2` or later.","status":"open","published_at":"2026-11-04T16:17:47+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","triaged_at":"2026-11-04T16:28:54+00:00","updated_at":"2026-11-04T16:28:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T16:28:54Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later.","reach":"network","title":"FreeRDP: malicious RDP server can corrupt client memory and crash it","impact":"medium","summary":"FreeRDP before 3.32.2 commits new image dimensions in its planar codec before buffer reallocation succeeds, so a failed reset leaves a heap out-of-bounds write reachable. A malicious RDP server can send an oversized ResetGraphics message followed by a GFX PLANAR command to corrupt client heap memory and crash the client.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop","linux","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Malicious server corrupts client heap memory and crashes the client","analyst_note":"","how_to_check":"- Check the FreeRDP version the client uses: `xfreerdp --version` or the version in the packaged library.\n- Look for any build or package using FreeRDP below `3.32.2`.\n- Note whether the client connects to RDP servers you do not control.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","trusted-servers-only"],"who_is_affected":"Any application or remote desktop client built on FreeRDP that connects to RDP servers, especially servers you do not control, is exposed. The flaw sits in the planar graphics codec, so a client that only talks to trusted servers carries lower risk. The sources do not say whether memory corruption can go beyond a client crash.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4216,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121954':13A,16A '-2026':12A,15A '3.32.2':27B,80C 'bitmap':95C 'bound':50B,87C 'buffer':37B,103C 'client':7A,71B,77B,130C,136C 'codec':35B,92C 'command':68B,127C 'commit':28B,99C 'context':97C 'corrupt':6A,70B,129C 'crash':10A,75B,134C 'cve':11A,14A 'desktop':22B 'dimens':31B,101C 'fail':42B,108C 'follow':63B 'freerdp':1A,17B,25B,78C,94C 'gfx':66B,125C 'heap':46B,72B,83C,131C 'imag':30B 'leav':44B 'linux':18B 'log':112C 'malici':2A,54B,114C 'memori':8A,73B,132C 'messag':62B 'new':29B,100C 'out-of-bound':47B,84C 'overs':60B,120C 'pdu':122C 'planar':34B,67B,91C,96C,126C 'rdp':3A,19B,55B,115C 'reachabl':52B 'realloc':38B,104C 'remot':21B 'remote-desktop':20B 'reset':43B,98C 'resetgraph':61B,109C,121C 'runtim':23B 'send':58B,118C 'server':4A,56B,116C 'succeed':39B,105C 'window':24B 'write':51B,88C","nicknames":[],"mitigations":[],"who_affected":"Any application or remote desktop client built on FreeRDP that connects to RDP servers, especially servers you do not control, is exposed. The flaw sits in the planar graphics codec, so a client that only talks to trusted servers carries lower risk. The sources do not say whether memory corruption can go beyond a client crash.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","linux","rdp","remotedesktop","runtime","windows"],"campaign_type":null,"first_public_at":"2026-10-20T17:14:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121954","severity":null,"published_at":"2026-11-04T16:17:47+00:00","modified_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","fetched_at":"2026-11-04T16:28:11+00:00","note":null}],"documents":[{"id":68478,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fg78-v8j5-8697","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:14:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68479,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-out-of-bounds-write-in-planar-codec","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}