CVE-2026-121398: FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module

Q: Which deployments are exposed to this issue?

Deployments using FreeRDP before 3.32.2 with the freerdp-proxy dyn-channel-dump module are affected. The listed software includes debian/freerdp3, debian/freerdp2, and FreeRDP freerdp.

Q: What must an attacker do to trigger the crash?

The attacker needs to operate or control a malicious RDP target that sends dynamic channel data while the front client disconnects. No attacker privileges or user interaction are required according to the supplied vector, but exploitation has high attack complexity.

Q: What is the impact of successful exploitation?

The client thread can read freed ChannelData during session teardown and crash the proxy process. The supplied impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

Q: What can be done if upgrading is not immediately possible?

The provided data does not identify a workaround. Reducing exposure to untrusted or malicious RDP targets would address the stated attack prerequisite until FreeRDP can be updated to 3.32.2 or later.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using FreeRDP before 3.32.2 with the freerdp-proxy dyn-channel-dump module are affected. The listed software includes debian/freerdp3, debian/freerdp2, and FreeRDP freerdp.

What must an attacker do to trigger the crash?

The attacker needs to operate or control a malicious RDP target that sends dynamic channel data while the front client disconnects. No attacker privileges or user interaction are required according to the supplied vector, but exploitation has high attack complexity.

What is the impact of successful exploitation?

The client thread can read freed ChannelData during session teardown and crash the proxy process. The supplied impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

What can be done if upgrading is not immediately possible?

The provided data does not identify a workaround. Reducing exposure to untrusted or malicious RDP targets would address the stated attack prerequisite until FreeRDP can be updated to 3.32.2 or later.

CVE-2026-121398: FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the crash?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the crash?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?