CVE-2026-121963 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP before 3.32.2 has a use-after-free in its asynchronous rdpsnd audio channel. A malicious RDP server can close the channel with queued audio data so the client reads freed memory, which crashes the client.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any client that connects to remote desktop servers using FreeRDP versions before 3.32.2 and the asynchronous dynamic rdpsnd audio channel. The attacker must control the RDP server the client connects to, so exposure comes from connecting to untrusted or compromised servers. Teams that only use FreeRDP against trusted servers face less risk, though the fix is still the upgrade. The sources do not say whether the asynchronous audio channel is enabled by default.
Not affected if freerdp-3.32.2-or-later, only-trusted-rdp-servers
Who cares freerdp, linux, remote-desktop, windows
xfreerdp --version) and compare it with the fixed release.3.32.2 or later.FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-121963") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.