UBUNTU-CVE-2026-121952: Critical severity ubuntu/freerdp vulnerability

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.

Affected Software

2 affected components

ubuntu/freerdp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using the FreeRDP proxy are exposed. The issue is triggered during processing of a client's Confirm Active message by the proxy.

What does an attacker need to do to exploit this?

An attacker needs to connect as a client to the proxy and send a Confirm Active message declaring fewer than five bitmap cache v2 cell caches. No authentication or user interaction is required according to the supplied severity vector.

UBUNTU-CVE-2026-121952: Critical severity ubuntu/freerdp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to exploit this?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to exploit this?