DEBIAN-CVE-2026-121398: Use After Free
FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the FreeRDP proxy with the dyn-channel-dump module are affected when they connect to a malicious RDP target. The affected Debian software entries are freerdp3 and freerdp2.
What must an attacker do to trigger the crash?
The attacker must control or act as the RDP target and send dynamic-channel data while the front-end client disconnects. Exploitation depends on this teardown timing race and does not require privileges or user interaction.
What is the practical impact?
The client thread can access freed ChannelData and crash the proxy process, causing an availability impact. The provided data does not indicate confidentiality or integrity impact.
What version information is available for remediation?
The issue affects FreeRDP versions before 3.32.2. The provided data does not specify the Debian package version containing the fix, so Debian package status must be checked separately.