{"id":"CVE-2026-121961","kind":"vulnerability","aliases":["CVE-2026-121961"],"related":[],"title":"FreeRDP proxy: use-after-free lets a malicious server crash the proxy","description":"FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.","summary":"FreeRDP's freerdp-proxy frees a memory context it still uses when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, causing the proxy process to crash.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","rdp","remote-desktop","runtime"],"not_affected_if":["no-freerdp-proxy","version-3.32.2-or-later"],"how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp --version` or `freerdp-proxy --version` (unknown if the sources do not give the command).\n- Look for whether `freerdp-proxy` is deployed in your environment, since the flaw is in the proxy component.","fix":"- FreeRDP versions before `3.32.2` are affected; move to `3.32.2` or later.","status":"open","published_at":"2026-11-04T16:17:49+00:00","first_seen_at":"2026-11-04T16:28:14+00:00","triaged_at":"2026-11-04T16:28:47+00:00","updated_at":"2026-11-04T16:28:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T16:28:47Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP versions before `3.32.2` are affected; move to `3.32.2` or later.","reach":"network","title":"FreeRDP proxy: use-after-free lets a malicious server crash the proxy","impact":"low","summary":"FreeRDP's freerdp-proxy frees a memory context it still uses when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, causing the proxy process to crash.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"proxy process crashes, causing denial of service","analyst_note":"Confirm the exact affected and fixed version ranges and whether the crash is the only impact, via the vendor advisory on GitHub and the VulnCheck advisory.","how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp --version` or `freerdp-proxy --version` (unknown if the sources do not give the command).\n- Look for whether `freerdp-proxy` is deployed in your environment, since the flaw is in the proxy component.","plain_action":"","needs_analyst":true,"not_affected_if":["no-freerdp-proxy","version-3.32.2-or-later"],"who_is_affected":"Only deployments running the freerdp-proxy component, which intercepts the drdynvc channel between clients and target servers. The flaw is triggered by a malicious target server, so exposure depends on whether untrusted servers can be reached through the proxy. Direct FreeRDP clients that do not run the proxy are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4199,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121961':16A,19A '-2026':15A,18A '3.32.2':66C 'activ':55B,98C 'borrow':108C 'caus':58B 'channel':42B,56B,85C,99C 'contain':67C 'context':34B,109C 'crash':11A,63B,111C 'creat':50B,93C 'cve':14A,17A 'data':103C 'desktop':24B 'drdynvc':41B,79C,84C 'free':6A,31B,72C,106C 'freerdp':1A,20B,26B,29B,64C,77C 'freerdp-proxi':28B,76C 'front':102C 'handl':104C 'id':57B,100C 'intercept':39B,82C 'let':7A 'malici':9A,44B,87C 'memori':33B 'pdu':52B,95C 'process':61B,114C 'proxi':2A,13A,30B,60B,78C,113C 'race':101C 'rdp':21B 'remot':23B 'remote-desktop':22B 'repeat':48B,91C 'request':51B,94C 'runtim':25B 'send':49B,92C 'server':10A,46B,89C 'still':36B 'target':45B,88C 'tracker':80C 'use':4A,37B,70C 'use-after-fre':3A,69C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running the freerdp-proxy component, which intercepts the drdynvc channel between clients and target servers. The flaw is triggered by a malicious target server, so exposure depends on whether untrusted servers can be reached through the proxy. Direct FreeRDP clients that do not run the proxy are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","rdp","remotedesktop","runtime"],"campaign_type":null,"first_public_at":"2026-10-20T17:10:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121961","severity":null,"published_at":"2026-11-04T16:17:49+00:00","modified_at":"2026-11-04T16:17:49+00:00","first_seen_at":"2026-11-04T16:28:14+00:00","fetched_at":"2026-11-04T16:28:14+00:00","note":null}],"documents":[{"id":68495,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:10:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68496,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-drdynvc-tracker-race","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}