DEBIAN-CVE-2026-121408: Use After Free
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loadinglock. A malicious RDP server can send a control-channel CLOSEREQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients using the urbdrc USB redirection channel are exposed when they connect to a malicious RDP server. The described crash requires the client to announce a USB device.
What does an attacker need to do to trigger the flaw?
An attacker controlling an RDP server must send a control-channel CLOSE_REQUEST while the client is announcing a USB device. This race can free the USB redirection channel before the announcement thread uses it, crashing the client.
Is this an impact on the RDP client or server?
The described effect is a client crash. The vulnerable client processes a malicious server's control-channel message and dereferences a freed channel pointer.
Which Debian packages are identified as affected?
The affected software listed is debian/freerdp3 and debian/freerdp2. The issue affects FreeRDP versions before 3.32.2.