GHSA-qw7w-hhxq-763c: FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.

Event History

Nov 4, 2026

CVE Published

via OSV·03:33 PM

Data Sourced

via OSV·03:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using freerdp-proxy and intercepting the drdynvc channel are exposed. The affected component is the proxy's DRDYNVC tracker.

What must an attacker do to trigger the vulnerability?

An attacker must control or operate a malicious target server that can send repeated CREATE_REQUEST_PDU messages for an active channel ID. Exploitation relies on racing front-side DATA handling so that a borrowed context is freed.

What is the expected impact?

Successful exploitation can crash the freerdp-proxy process, resulting in a denial of service. The provided impact vector identifies availability impact only.

What version resolves the issue?

Upgrade FreeRDP to version 3.32.2 or later. Versions before 3.32.2 are affected.

GHSA-qw7w-hhxq-763c: FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected impact?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected impact?

What version resolves the issue?