UBUNTU-CVE-2026-121961: Use After Free

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.

Affected Software

2 affected components

ubuntu/freerdp*

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP proxy deployments that intercept the drdynvc channel are exposed. The issue is triggered by a malicious target server, rather than requiring an unauthenticated client to attack the proxy directly.

What must an attacker do to trigger the crash?

The attacker must control or act as a malicious target server and repeatedly send CREATE_REQUEST_PDU messages for an active channel ID. Exploitation relies on racing front-side DATA handling so that a borrowed context is freed while still in use.

What is the practical impact?

Successful exploitation can crash the FreeRDP proxy process, causing a denial of service. The provided data does not describe confidentiality or integrity impact.

UBUNTU-CVE-2026-121961: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the crash?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the crash?

What is the practical impact?