Heap Out-of-Bounds Write in FreeRDP RDPGFX Client

CVE-2026-121958

What is CVE-2026-121958?

FreeRDP versions up to 3.32.1 contain a vulnerability that allows an attacker to exploit a heap out-of-bounds write through improper handling of surface hash keys in the RDPGFX client. The issue arises when the delete_surface callback improperly truncates surface hash keys to 16 bits, resulting in a mismatch within the surface table. An attacker, or a man-in-the-middle RDP server, can exploit this vulnerability by sending crafted DELETESURFACE PDUs with a surfaceId set to 0xFFFF, which can lead to writing beyond the allocated key array, thereby compromising the system's integrity.

References