CVE-2026-121962 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP clients mishandle a split four-byte Early User Authorization result during CredSSP hybrid-extended connections, writing past a 16 KiB heap buffer. A malicious RDP server can use this to crash the client, and an out-of-bounds write can enable more.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone running a FreeRDP client before 3.32.2 that connects to RDP servers using PROTOCOL_HYBRID_EX CredSSP. The risk comes from connecting to a malicious or compromised RDP server, so clients that only connect to trusted servers are less exposed. Sources do not describe any server-side exposure.
Not affected if fixed-version, trusted-servers-only
Who cares freerdp, linux, rdp-clients, windows
xfreerdp /version.3.32.2 or later.FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-121962") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.