Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-121953 · CRITICAL · CVSS 9.8 FreeRDP before version 3.32.2 has a use-after-free weakness in the rdpgfx dynamic virtual channel. A malicious RDP server can potentially crash the client. The impact is uncertain. CVSS 3.1 · VulnCheck https://cve.new/CVE-2026-121953
🚨 Alerta 2026-141 | FreeRDP: dos fallas críticas (CVSS 9.8) en proxy y cliente. CVE-2026-121952 (escritura fuera de límites) y CVE-2026-121953 (use-after-free en rdpgfx). Afecta versiones previas a 3.32.2; hay PoC. Actualiza a 3.32.2. #FreeRDP #CVE https://beaconlab.us/publicacion/alerta-2026-141-vulnerabilidades-criticas-en-freerdp/
🆕 New CVEs FreeRDP: 2 critical CVEs Worst: out-of-bounds write in RDP proxy bitmap cache handling (CVE-2026-121952) Patch → 3.32.2 https://cve.now/CVE-2026-121952?release=CVE-2026-121953&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freerdp | freerdp | - | - | - |