I’M UNDER A CYBER ATTACK

Alert

Alert 2026-141 Critical vulnerabilities in FreeRDP

Affected product(s): 

ProductAffected versions
FreeRDPEarlier than 3.32.2
FreeRDP proxy (freerdp-proxy) — CVE-2026-121952≤ 3.32.1, with the proxy enabled
FreeRDP client with rdpgfx channel — CVE-2026-121953≤ 3.32.1, with the graphics pipeline / rdpgfx loaded

Applications that integrate FreeRDP are exposed if they link against a library earlier than 3.32.2.

Description

Two critical-severity vulnerabilities have been published in FreeRDP, an open-source implementation of the RDP protocol used as a client, server, and proxy. Both carry CVSSv3.1 9.8 (CRITICAL) and CVSSv4 9.3 (CRITICAL) ratings. They are fixed in FreeRDP 3.32.2, released on Oct 12, 2026; the CVE identifiers were assigned on Nov 4, 2026.

CVE-2026-121952 is an out-of-bounds write in the proxy when handling the Bitmap Cache v2 capability. The project stated that a client connecting to the proxy can specify an invalid number of bitmap cache cells and cause memory corruption in the proxy process, data leakage to the backend server, or a service outage. The CNA vector indicates network, low complexity, and no privileges or user interaction. If the proxy configuration requires authentication, the attacker must first authenticate.

CVE-2026-121953 is a use-after-free in the client, on the dynamic graphics channel rdpgfx. Researchers indicate that a malicious or compromised RDP server can, after the handshake and with rdpgfx active, trigger a use-after-free that leads to a client crash or, potentially, code execution. The CNA vector also indicates no privileges or user interaction; in practice, the client must establish a session with that server. The same root cause also affects the rdpsnd audio channel.

The same 3.32.2 release fixes a broad set of project security advisories (dozens of GHSAs) and other CVEs in the batch, including a TLS certificate identity validation bypass (CVE-2026-121392, CVSSv4 9.1 / CVSSv3.1 7.4), which allows a man-in-the-middle attacker with a certificate issued by a CA already trusted by the client to intercept the RDP session, as well as several additional memory corruption and denial-of-service flaws (CVE-2026-121950 through CVE-2026-121964).

As of Nov 4, 2026, they are not listed in catalogs of known exploited vulnerabilities and do not yet have EPSS scores. The project advisories include proof-of-concept reproductions. There are no confirmed reports of active exploitation.

Mitigation

The project did not publish any workarounds other than updating. The following are recommended:

  • Update FreeRDP (client, server, and proxy) to 3.32.2 or later, or install the distribution’s patched package.
  • If freerdp-proxy is used, do not expose it to the Internet; restrict access to administrative networks or VPNs and require authentication.
  • Avoid connections from FreeRDP clients to untrusted RDP servers; validate certificates and do not ignore warnings.
  • Inventory applications that integrate libfreerdp and update or recompile them against 3.32.2 or later.
  • On Debian, prioritize packages ≥ 3.32.2+dfsg-1 where available; according to the distribution, trixie (freerdp3) and freerdp2 remain vulnerable.
  • On RHEL 10, apply the freerdp-3.32.2-1.el10_2 package (RHSA-2026:94514), which provides the fixed version.

Solution

The solution is to update FreeRDP to version 3.32.2 or later, which fixes CVE-2026-121952, CVE-2026-121953, and the rest of the release’s security batch. In packaged environments, install the distribution’s patched package (for example, freerdp 3.32.2 in Debian forky/sid or freerdp-3.32.2-1.el10_2 in RHEL 10).

For information on how to update, visit the following link:

https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2

Additional information: