{"id":12413,"date":"2026-11-04T20:25:37","date_gmt":"2026-11-05T02:25:37","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-141-critical-vulnerabilities-in-freerdp\/"},"modified":"2026-11-04T21:11:17","modified_gmt":"2026-11-05T03:11:17","slug":"alert-2026-141-critical-vulnerabilities-in-freerdp","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-141-critical-vulnerabilities-in-freerdp\/","title":{"rendered":"Alert 2026-141 Critical vulnerabilities in FreeRDP"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
FreeRDP<\/strong><\/td>Earlier than 3.32.2<\/td><\/tr>
FreeRDP proxy (freerdp-proxy<\/code>) \u2014 CVE-2026-121952<\/strong><\/td>\u2264 3.32.1, with the proxy enabled<\/td><\/tr>
FreeRDP client with rdpgfx channel \u2014 CVE-2026-121953<\/strong><\/td>\u2264 3.32.1, with the graphics pipeline \/ rdpgfx loaded<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Applications that integrate FreeRDP are exposed if they link against a library earlier than 3.32.2.<\/p>\n\n

Description<\/h2>\n\n

Two critical-severity vulnerabilities have been published in FreeRDP, an open-source implementation of the RDP protocol used as a client, server, and proxy. Both carry CVSSv3.1 9.8 (CRITICAL) and CVSSv4 9.3 (CRITICAL) ratings. They are fixed in FreeRDP 3.32.2, released on Oct 12, 2026; the CVE identifiers were assigned on Nov 4, 2026.<\/p>\n\n

CVE-2026-121952 is an out-of-bounds write in the proxy when handling the Bitmap Cache v2 capability. The project stated that a client connecting to the proxy can specify an invalid number of bitmap cache cells and cause memory corruption in the proxy process, data leakage to the backend server, or a service outage. The CNA vector indicates network, low complexity, and no privileges or user interaction. If the proxy configuration requires authentication, the attacker must first authenticate.<\/p>\n\n

CVE-2026-121953 is a use-after-free in the client, on the dynamic graphics channel rdpgfx. Researchers indicate that a malicious or compromised RDP server can, after the handshake and with rdpgfx active, trigger a use-after-free that leads to a client crash or, potentially, code execution. The CNA vector also indicates no privileges or user interaction; in practice, the client must establish a session with that server. The same root cause also affects the rdpsnd audio channel.<\/p>\n\n

The same 3.32.2 release fixes a broad set of project security advisories (dozens of GHSAs) and other CVEs in the batch, including a TLS certificate identity validation bypass (CVE-2026-121392, CVSSv4 9.1 \/ CVSSv3.1 7.4), which allows a man-in-the-middle attacker with a certificate issued by a CA already trusted by the client to intercept the RDP session, as well as several additional memory corruption and denial-of-service flaws (CVE-2026-121950 through CVE-2026-121964).<\/p>\n\n

As of Nov 4, 2026, they are not listed in catalogs of known exploited vulnerabilities and do not yet have EPSS scores. The project advisories include proof-of-concept reproductions. There are no confirmed reports of active exploitation.<\/p>\n\n

Mitigation<\/h2>\n\n

The project did not publish any workarounds other than updating. The following are recommended:<\/p>\n\n