Heap Buffer Overflow in FreeRDP by FreeRDP Project

CVE-2026-121962

What is CVE-2026-121962?

The FreeRDP product prior to version 3.32.2 suffers from a heap buffer overflow vulnerability in the transport_default_read_pdu function. This issue occurs when the RDP client processes partial Early User Authorization (EUA) reads under the PROTOCOL_HYBRID_EX CredSSP. An attacker can exploit this flaw by controlling the RDP server to segment a four-byte EUA result, leading to short reads that push the stream pointer past the allocated 16 KiB buffer. This manipulation results in an out-of-bounds write, which can ultimately cause a denial of service for the client.

References