Heap-based Buffer Overflow in FreeRDP Before Version 3.32.2

CVE-2026-121964

What is CVE-2026-121964?

FreeRDP, prior to version 3.32.2, is vulnerable to a heap-based buffer overflow in the RD Gateway RPC client. This vulnerability arises when the rpc_client_recv_fragment function improperly processes BIND_ACK and ALTER_CONTEXT_RESP fragments, checking only the total capacity instead of the remaining capacity in the current data stream. Malicious actors or compromised RD Gateways can exploit this flaw by sending malicious RPC fragments with crafted alloc_hint and frag_length parameters, potentially allowing them to overwrite client heap memory with arbitrary data. This can result in application crashes or the execution of arbitrary code, posing significant security risks.

References