{"id":"CVE-2026-121957","kind":"vulnerability","aliases":["CVE-2026-121957"],"related":[],"title":"FreeRDP: use-after-free lets a malicious RDP server corrupt client memory","description":"FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.","summary":"FreeRDP before 3.32.2 has a race between the RDPGFX ResetGraphics handler and the planar bitmap decoder that causes a use-after-free. A malicious RDP server can send crafted graphics commands to corrupt client heap memory.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","package","rdp","remote-desktop","windows"],"not_affected_if":["fixed-version","trusted-servers-only"],"how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it against `3.32.2`.\n- Look for FreeRDP builds bundled inside other applications, since they may not update with the system package.","fix":"- FreeRDP: upgrade to `3.32.2` or later.","status":"open","published_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","triaged_at":"2026-11-04T16:28:42+00:00","updated_at":"2026-11-04T16:28:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T16:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: upgrade to `3.32.2` or later.","reach":"network","title":"FreeRDP: use-after-free lets a malicious RDP server corrupt client memory","impact":"high","summary":"FreeRDP before 3.32.2 has a race between the RDPGFX ResetGraphics handler and the planar bitmap decoder that causes a use-after-free. A malicious RDP server can send crafted graphics commands to corrupt client heap memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop","linux","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts client memory, possibly running code on the client.","analyst_note":"Confirm whether the vendor advisory on github.com and the VulnCheck advisory state the fixed version and whether the race needs any user action to trigger.","how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it against `3.32.2`.\n- Look for FreeRDP builds bundled inside other applications, since they may not update with the system package.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","trusted-servers-only"],"who_is_affected":"Any client that connects to RDP servers using FreeRDP before 3.32.2 can be affected, since the bug is triggered by the server sending graphics data. Exposure depends on whether clients connect to untrusted or internet-facing RDP servers. Teams that only connect to trusted internal servers face lower risk, but should still patch.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4216,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121957':16A,19A '-2026':15A,18A '3.32.2':30B,67C '32':105C 'allow':76C 'attack':95C 'bitmap':42B,93C,103C 'bound':120C 'bpp':106C 'buffer':125C 'caus':45B 'client':12A,62B,82C 'command':59B 'compress':102C 'concurr':100C 'contain':68C 'corrupt':11A,61B,81C 'craft':57B 'cve':14A,17A 'decod':43B,94C 'desktop':26B 'free':5A,50B,73C,115C 'freerdp':1A,20B,28B,65C 'graphic':58B 'handler':38B,89C 'heap':63B,111C 'let':6A 'linux':21B 'malici':8A,52B,77C 'memori':13A,64B,83C 'out-of-bound':117C 'packag':22B 'planar':41B,92C,124C 'race':33B,85C 'rdp':9A,23B,53B,78C 'rdpgfx':36B,87C 'read/write':121C 'remot':25B 'remote-desktop':24B 'resetgraph':37B,88C,98C 'send':56B,97C,101C 'server':10A,54B,79C 'share':123C 'trigger':110C 'use':3A,48B,71C,113C 'use-after-fre':2A,47B,70C,112C 'vulner':74C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Any client that connects to RDP servers using FreeRDP before 3.32.2 can be affected, since the bug is triggered by the server sending graphics data. Exposure depends on whether clients connect to untrusted or internet-facing RDP servers. Teams that only connect to trusted internal servers face lower risk, but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","linux","package","rdp","remotedesktop","windows"],"campaign_type":null,"first_public_at":"2026-10-20T17:12:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121957","severity":null,"published_at":"2026-11-04T16:17:48+00:00","modified_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","fetched_at":"2026-11-04T16:28:11+00:00","note":null}],"documents":[{"id":68486,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:12:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68488,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}