Out-of-Bounds Write Vulnerability in FreeRDP Proxy by FreeRDP
CVE-2026-121952

9.3CRITICAL

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121952?

FreeRDP before version 3.32.2 contains an out-of-bounds write vulnerability in its proxy component. The issue arises when the function rdp_read_bitmap_cache_v2_capability_set incorrectly handles the number of cell caches, accepting values less than five. This improper validation leads to potential heap corruption and data leakage as the bitmap cache v2 cell array is accessed at fixed indices, causing instability and crashes in client connections. Users are advised to update to the latest version to mitigate these risks.

Affected Version(s)

FreeRDP 0 < 3.32.2

FreeRDP 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32....
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

smaeljaish771
KeenSecurityLab
.