CVE-2026-121961: FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

Q: Which deployments are exposed to this issue?

The affected component is freerdp-proxy when it intercepts the drdynvc channel. The listed software includes Debian freerdp3 and freerdp2 packages; versions before 3.32.2 are affected according to the provided advisory data.

Q: What does an attacker need to do to exploit the flaw?

An attacker needs to control or operate a malicious target RDP server that the proxy connects to. The server repeatedly sends CREATE_REQUEST_PDU messages for an active DRDYNVC channel ID to race front-side DATA handling.

Q: What is the likely impact of successful exploitation?

Successful exploitation can free a borrowed context while it is still used, causing the freerdp-proxy process to crash. The supplied vector indicates network reachability with no privileges or user interaction required, but high attack complexity.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected component is freerdp-proxy when it intercepts the drdynvc channel. The listed software includes Debian freerdp3 and freerdp2 packages; versions before 3.32.2 are affected according to the provided advisory data.

What does an attacker need to do to exploit the flaw?

An attacker needs to control or operate a malicious target RDP server that the proxy connects to. The server repeatedly sends CREATE_REQUEST_PDU messages for an active DRDYNVC channel ID to race front-side DATA handling.

What is the likely impact of successful exploitation?

Successful exploitation can free a borrowed context while it is still used, causing the freerdp-proxy process to crash. The supplied vector indicates network reachability with no privileges or user interaction required, but high attack complexity.

CVE-2026-121961: FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit the flaw?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit the flaw?

What is the likely impact of successful exploitation?