CVE-2026-121963: FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

Q: Who can trigger this vulnerability?

A malicious RDP server can trigger it against a vulnerable FreeRDP client. No authentication or user interaction is required according to the provided CVSS vector.

Q: What is the practical impact?

The described outcome is a client crash when the playback thread accesses a freed rdpsnd callback after the server closes the dynamic audio channel with queued audio PDUs. The provided CVSS vector indicates availability impact only, with no confidentiality or integrity impact.

Q: What does an attacker need to send?

The server must use the asynchronous dynamic rdpsnd channel, send a training PDU, and then close the channel while audio PDUs remain queued. This causes rdpsnd_virtual_channel_write to access a freed callback.

Q: Which listed software packages should be reviewed?

The affected software list includes debian/freerdp3 and debian/freerdp2. The vulnerability affects FreeRDP versions before 3.32.2.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsndvirtualchannelwrite, crashing the client.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can trigger this vulnerability?

A malicious RDP server can trigger it against a vulnerable FreeRDP client. No authentication or user interaction is required according to the provided CVSS vector.

What is the practical impact?

The described outcome is a client crash when the playback thread accesses a freed rdpsnd callback after the server closes the dynamic audio channel with queued audio PDUs. The provided CVSS vector indicates availability impact only, with no confidentiality or integrity impact.

What does an attacker need to send?

The server must use the asynchronous dynamic rdpsnd channel, send a training PDU, and then close the channel while audio PDUs remain queued. This causes rdpsnd_virtual_channel_write to access a freed callback.

Which listed software packages should be reviewed?

The affected software list includes debian/freerdp3 and debian/freerdp2. The vulnerability affects FreeRDP versions before 3.32.2.

CVE-2026-121963: FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can trigger this vulnerability?

What is the practical impact?

What does an attacker need to send?

Which listed software packages should be reviewed?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger this vulnerability?

What is the practical impact?

What does an attacker need to send?

Which listed software packages should be reviewed?