CVE-2026-121961 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeRDP's freerdp-proxy frees a memory context it still uses when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, causing the proxy process to crash.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only deployments running the freerdp-proxy component, which intercepts the drdynvc channel between clients and target servers. The flaw is triggered by a malicious target server, so exposure depends on whether untrusted servers can be reached through the proxy. Direct FreeRDP clients that do not run the proxy are not described as affected by the sources.
Not affected if no-freerdp-proxy, version-3.32.2-or-later
Who cares freerdp, rdp, remote-desktop
xfreerdp --version or freerdp-proxy --version (unknown if the sources do not give the command).freerdp-proxy is deployed in your environment, since the flaw is in the proxy component.3.32.2 are affected; move to 3.32.2 or later.FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121961") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.