UBUNTU-CVE-2026-121398: Use After Free

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects FreeRDP proxy deployments using the dyn-channel-dump module. Exploitation involves a malicious RDP target sending dynamic-channel data during teardown while the front-end client disconnects.

What does an attacker need to do to trigger the vulnerability?

An attacker needs to operate or control a malicious RDP target that the proxy connects to. They must send dynamic-channel data during the race window created when the front client disconnects and the session is being torn down.

What is the expected impact of successful exploitation?

The client thread can access freed ChannelData, causing the FreeRDP proxy process to crash. The provided impact information indicates availability impact only, with no stated confidentiality or integrity impact.

UBUNTU-CVE-2026-121398: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the expected impact of successful exploitation?