UBUNTU-CVE-2026-121963: Use After Free

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsndvirtualchannelwrite, crashing the client.

Affected Software

2 affected components

ubuntu/freerdp*

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients before 3.32.2 are exposed when they connect to a malicious RDP server. The issue is in the asynchronous dynamic rdpsnd audio channel, so exploitation depends on the client processing that channel's audio traffic.

What does an attacker need to do to trigger the vulnerability?

An attacker needs to operate or control an RDP server that the victim's FreeRDP client connects to. The server can send a training PDU and then close the channel while audio PDUs remain queued, causing the playback thread to access a freed callback.

What is the known impact?

The described result is a client crash caused by freed callback access in rdpsnd_virtual_channel_write. The provided data does not describe code execution, data disclosure, or integrity impact.

How can I determine whether a system is affected?

Check the installed FreeRDP version. Versions before 3.32.2 are affected according to the provided advisory information.

UBUNTU-CVE-2026-121963: Use After Free

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the known impact?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the known impact?

How can I determine whether a system is affected?