UBUNTU-CVE-2026-121408: Use After Free

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loadinglock. A malicious RDP server can send a control-channel CLOSEREQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Ubuntu systems using the listed FreeRDP packages are affected if they run a FreeRDP version earlier than 3.32.2 and use the urbdrc USB redirection channel. The issue affects the RDP client, not a server receiving an RDP connection.

What must an attacker do to trigger the flaw?

An attacker must operate or control a malicious RDP server that the victim connects to. The server can send a control-channel CLOSE_REQUEST while the client is announcing a redirected USB device, causing the client to crash.

What is the practical impact?

The described impact is a client crash, resulting in denial of service. The provided information does not indicate confidentiality loss, integrity loss, or code execution.

UBUNTU-CVE-2026-121408: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker do to trigger the flaw?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker do to trigger the flaw?

What is the practical impact?