CVE-2026-121957 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP before 3.32.2 has a race between the RDPGFX ResetGraphics handler and the planar bitmap decoder that causes a use-after-free. A malicious RDP server can send crafted graphics commands to corrupt client heap memory.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any client that connects to RDP servers using FreeRDP before 3.32.2 can be affected, since the bug is triggered by the server sending graphics data. Exposure depends on whether clients connect to untrusted or internet-facing RDP servers. Teams that only connect to trusted internal servers face lower risk, but should still patch.
Not affected if fixed-version, trusted-servers-only
Who cares freerdp, linux, rdp, remote-desktop, windows
xfreerdp /version, and compare it against 3.32.2.3.32.2 or later.FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.
This page as .md · .json · in your agent: get_signal("CVE-2026-121957") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.