CVE-2026-121953: FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

Q: Who can exploit this issue?

An attacker controlling a malicious RDP server can target a FreeRDP client. Exploitation does not require authentication or user interaction beyond the client connecting to that server.

Q: Which FreeRDP releases are affected?

FreeRDP versions before 3.32.2 are affected. The listed software includes Debian freerdp3 and freerdp2 packages, but the provided data does not specify their fixed package versions.

Q: What could exploitation do?

The malicious server can trigger a use-after-free by manipulating the rdpgfx dynamic virtual channel, then sending a PDU on the original channel. This can crash the client and may allow code execution.

Q: How can this be mitigated if upgrading is not immediately possible?

The provided data identifies malicious RDP servers as the attack source. Until an update is available, avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfxonclose frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker controlling a malicious RDP server can target a FreeRDP client. Exploitation does not require authentication or user interaction beyond the client connecting to that server.

Which FreeRDP releases are affected?

FreeRDP versions before 3.32.2 are affected. The listed software includes Debian freerdp3 and freerdp2 packages, but the provided data does not specify their fixed package versions.

What could exploitation do?

The malicious server can trigger a use-after-free by manipulating the rdpgfx dynamic virtual channel, then sending a PDU on the original channel. This can crash the client and may allow code execution.

How can this be mitigated if upgrading is not immediately possible?

The provided data identifies malicious RDP servers as the attack source. Until an update is available, avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers.

CVE-2026-121953: FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which FreeRDP releases are affected?

What could exploitation do?

How can this be mitigated if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which FreeRDP releases are affected?

What could exploitation do?

How can this be mitigated if upgrading is not immediately possible?