CVE-2026-121962: FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read

Q: What must an attacker control to exploit this issue?

An attacker must operate or control a malicious RDP server and induce a FreeRDP client to connect to it. Exploitation occurs during PROTOCOL_HYBRID_EX CredSSP handling when the server delivers the four-byte Early User Authorization result in short reads.

Q: Are clients using the default RDP transport affected?

The issue is in transport_default_read_pdu and is specifically described for PROTOCOL_HYBRID_EX CredSSP. The provided data does not establish whether other protocol configurations or transports are affected.

Q: What is the known impact of a successful exploit?

The malformed short reads can advance a stream pointer beyond a 16 KiB allocation and cause an out-of-bounds write. The described impact is client denial of service, with high integrity and availability impact reflected in the supplied severity vector.

Q: Which listed software packages should be reviewed?

Review deployments of debian/freerdp3 and debian/freerdp2. The vulnerability affects FreeRDP versions before 3.32.2; the provided data does not state which package revisions contain the fix.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a heap buffer overflow in transportdefaultreadpdu when handling partial Early User Authorization reads during PROTOCOLHYBRIDEX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control to exploit this issue?

An attacker must operate or control a malicious RDP server and induce a FreeRDP client to connect to it. Exploitation occurs during PROTOCOL_HYBRID_EX CredSSP handling when the server delivers the four-byte Early User Authorization result in short reads.

Are clients using the default RDP transport affected?

The issue is in transport_default_read_pdu and is specifically described for PROTOCOL_HYBRID_EX CredSSP. The provided data does not establish whether other protocol configurations or transports are affected.

What is the known impact of a successful exploit?

The malformed short reads can advance a stream pointer beyond a 16 KiB allocation and cause an out-of-bounds write. The described impact is client denial of service, with high integrity and availability impact reflected in the supplied severity vector.

Which listed software packages should be reviewed?

Review deployments of debian/freerdp3 and debian/freerdp2. The vulnerability affects FreeRDP versions before 3.32.2; the provided data does not state which package revisions contain the fix.

CVE-2026-121962: FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to exploit this issue?

Are clients using the default RDP transport affected?

What is the known impact of a successful exploit?

Which listed software packages should be reviewed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to exploit this issue?

Are clients using the default RDP transport affected?

What is the known impact of a successful exploit?

Which listed software packages should be reviewed?