CVE-2026-121958 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP through 3.32.1 has a heap out-of-bounds write in its RDPGFX graphics client, caused by a surface-key truncation bug in the delete_surface callback. A malicious or man-in-the-middle RDP server can trigger it with crafted surface delete and frame messages, corrupting client memory.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any client built on FreeRDP that connects to RDP servers with the RDPGFX graphics channel, which is the default graphics path in many builds. The exploit needs the client to connect to a hostile or intercepted server, so teams that only connect to trusted internal servers face lower risk. unknown whether the sources list default settings beyond this.
Not affected if no-freerdp-clients, trusted-servers-only
Who cares c, freerdp, rdp, remote-desktop
xfreerdp --version, and compare it to the fixed release in the vendor advisory.3.32.1 are the sources' stated range; the specific fixed version is unknown from the sources.FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.
This page as .md · .json · in your agent: get_signal("CVE-2026-121958") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.