CVE-2026-121958: FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

Q: Which systems are exposed to this issue?

The affected component is the FreeRDP RDPGFX client. Systems using FreeRDP to connect to RDP servers are exposed when they connect to a malicious server or a server whose connection can be manipulated by a man-in-the-middle attacker.

Q: How can I determine whether my FreeRDP deployment may be affected?

FreeRDP versions through 3.32.1 are affected. The listed Debian software entries are debian/freerdp2 and debian/freerdp3; no fixed package version is provided in the available data.

Q: Does exploitation require an authenticated local account or elevated privileges?

No privileges are required by the attacker according to the supplied vector. Exploitation requires user interaction, consistent with a user initiating or participating in an RDP connection to the attacker-controlled or intercepted server.

Published Nov 4, 2026

Updated

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTableGetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The affected component is the FreeRDP RDPGFX client. Systems using FreeRDP to connect to RDP servers are exposed when they connect to a malicious server or a server whose connection can be manipulated by a man-in-the-middle attacker.

How can I determine whether my FreeRDP deployment may be affected?

FreeRDP versions through 3.32.1 are affected. The listed Debian software entries are debian/freerdp2 and debian/freerdp3; no fixed package version is provided in the available data.

Does exploitation require an authenticated local account or elevated privileges?

No privileges are required by the attacker according to the supplied vector. Exploitation requires user interaction, consistent with a user initiating or participating in an RDP connection to the attacker-controlled or intercepted server.

CVE-2026-121958: FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

How can I determine whether my FreeRDP deployment may be affected?

Does exploitation require an authenticated local account or elevated privileges?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

How can I determine whether my FreeRDP deployment may be affected?

Does exploitation require an authenticated local account or elevated privileges?