---
id: "CVE-2026-121957"
kind: "vulnerability"
aliases: ["CVE-2026-121957"]
title: "FreeRDP: use-after-free lets a malicious RDP server corrupt client memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["freerdp", "linux", "package", "rdp", "remote-desktop", "windows"]
not_affected_if: ["fixed-version", "trusted-servers-only"]
published_at: "2026-11-04T16:17:48+00:00"
first_seen_at: "2026-11-04T16:28:11+00:00"
updated_at: "2026-11-04T16:28:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121957", "first_seen_at": "2026-11-04T16:28:11+00:00"}]
---

# FreeRDP: use-after-free lets a malicious RDP server corrupt client memory

FreeRDP before 3.32.2 has a race between the RDPGFX ResetGraphics handler and the planar bitmap decoder that causes a use-after-free. A malicious RDP server can send crafted graphics commands to corrupt client heap memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it against `3.32.2`.
- Look for FreeRDP builds bundled inside other applications, since they may not update with the system package.

## Fix

- FreeRDP: upgrade to `3.32.2` or later.

## Timeline

- 2026-11-04T16:28:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121957

## Documents

- [advisory] Vendor advisory: github.com https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race

## From the sources

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_