CVE-2026-121957: FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

Q: Who can exploit this issue?

A malicious RDP server can exploit a vulnerable FreeRDP client remotely. No authentication or user interaction is required according to the supplied CVSS vector.

Q: What traffic is required to trigger the flaw?

The server must race RDPGFX ResetGraphics messages against compressed planar bitmap decoding, using bitmaps with a color depth of 32 bpp or higher. This can cause use-after-free or out-of-bounds memory access in shared planar buffers.

Q: Which deployments are identified as affected?

The affected software list includes Debian freerdp2 and freerdp3 packages. FreeRDP versions before 3.32.2 are described as vulnerable.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A malicious RDP server can exploit a vulnerable FreeRDP client remotely. No authentication or user interaction is required according to the supplied CVSS vector.

What traffic is required to trigger the flaw?

The server must race RDPGFX ResetGraphics messages against compressed planar bitmap decoding, using bitmaps with a color depth of 32 bpp or higher. This can cause use-after-free or out-of-bounds memory access in shared planar buffers.

Which deployments are identified as affected?

The affected software list includes Debian freerdp2 and freerdp3 packages. FreeRDP versions before 3.32.2 are described as vulnerable.

CVE-2026-121957: FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What traffic is required to trigger the flaw?

Which deployments are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What traffic is required to trigger the flaw?

Which deployments are identified as affected?