CVE-2026-121408: FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
Published Nov 3, 2026
·Updated
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loadinglock. A malicious RDP server can send a control-channel CLOSEREQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.
Affected Software
1 affected component
FreeRDP freerdp<3.32.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Nov 3, 2026
CVE Published
via MITRE·02:28 PM
Data Sourced
via MITRE·02:28 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeaknessAffected Software