GHSA-6wqx-rv3q-vcxp: FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfxonclose frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

Event History

Nov 4, 2026

CVE Published

via OSV·03:33 PM

Data Sourced

via OSV·03:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients running versions before 3.32.2 are exposed when they connect to a malicious RDP server. The server can trigger the vulnerable rdpgfx dynamic virtual channel behavior remotely.

What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that the vulnerable FreeRDP client connects to. No client-side privileges or user interaction beyond making that RDP connection are indicated.

What can happen if exploitation succeeds?

A malicious server can crash the FreeRDP client by sending a PDU on the original channel after closing a duplicate-name channel. The use-after-free may also permit code execution.

How can this be remediated?

Upgrade FreeRDP to version 3.32.2 or later. The affected versions are those before 3.32.2.

GHSA-6wqx-rv3q-vcxp: FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can happen if exploitation succeeds?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can happen if exploitation succeeds?

How can this be remediated?