CVE-2026-121952: FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

Q: Which deployments are exposed to this issue?

Deployments using the FreeRDP proxy are exposed when they run a version before 3.32.2. The issue is triggered by a client connecting to that proxy.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network reachability, low attack complexity, no privileges, and no user interaction are required.

Q: What must an attacker send to trigger the flaw?

The attacker must connect to the proxy and send a Confirm Active message declaring fewer than five Bitmap Cache v2 cell caches. The proxy later accesses fixed cell-array indices 0 through 4, resulting in an out-of-bounds write.

Q: What can happen if the proxy is exploited?

The reported impacts include heap corruption, leakage of heap data to the backend, and a proxy crash. The severity vector also rates confidentiality, integrity, and availability impact as high.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the FreeRDP proxy are exposed when they run a version before 3.32.2. The issue is triggered by a client connecting to that proxy.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network reachability, low attack complexity, no privileges, and no user interaction are required.

What must an attacker send to trigger the flaw?

The attacker must connect to the proxy and send a Confirm Active message declaring fewer than five Bitmap Cache v2 cell caches. The proxy later accesses fixed cell-array indices 0 through 4, resulting in an out-of-bounds write.

What can happen if the proxy is exploited?

The reported impacts include heap corruption, leakage of heap data to the backend, and a proxy crash. The severity vector also rates confidentiality, integrity, and availability impact as high.

CVE-2026-121952: FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What must an attacker send to trigger the flaw?

What can happen if the proxy is exploited?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What must an attacker send to trigger the flaw?

What can happen if the proxy is exploited?