FreeRDP: 25 Vulnerabilities Disclosed in Batch, Ranging from Critical to Low
A batch of 25 CVEs affecting FreeRDP were disclosed, with vulnerabilities including critical use-after-free, heap overflows, and denial-of-service flaws.
Key findings
- 25 vulnerabilities disclosed in FreeRDP, affecting versions prior to 3.32.2.
- Critical vulnerabilities include use-after-free and out-of-bounds writes (CVE-2026-121953, CVE-2026-121952).
- High-severity flaws involve heap overflows, double frees, and memory corruption.
- Numerous medium-severity vulnerabilities lead to denial of service and resource exhaustion.
- All users are urged to update to FreeRDP version 3.32.2 or later.
On November 3rd and 4th, 2026, a significant batch of 25 vulnerabilities was disclosed for the FreeRDP remote desktop protocol client and server. These vulnerabilities, affecting versions prior to 3.32.2, span a range of severities, including critical, high, medium, and low, with potential impacts including remote code execution, denial of service, and information disclosure.
Several critical and high-severity vulnerabilities were detailed, including use-after-free flaws (CVE-2026-121963, CVE-2026-121957, CVE-2026-121953, CVE-2026-121950), heap-based buffer overflows (CVE-2026-121964, CVE-2026-121962, CVE-2026-121958), and denial-of-service issues (CVE-2026-121960, CVE-2026-121959, CVE-2026-121403, CVE-2026-121404, CVE-2026-121406, CVE-2026-121407, CVE-2026-121409, CVE-2026-121410).
Specifically, CVE-2026-121953 and CVE-2026-121952, both rated critical with a CVSSv3 score of 9.8, involve use-after-free and out-of-bounds writes, respectively. These could allow malicious RDP servers to corrupt client memory or crash the proxy process.
Other high-severity vulnerabilities include heap out-of-bounds writes (CVE-2026-121958), double frees (CVE-2026-121956), and various memory corruption issues stemming from improper handling of RDPGFX and CredSSP protocols.
Medium-severity vulnerabilities also present a significant risk, with many related to denial of service through resource exhaustion or assertion failures. These include infinite loops (CVE-2026-121959), uncontrolled resource consumption (CVE-2026-121412), and assertion failures due to malformed PDUs (CVE-2026-121955, CVE-2026-121951, CVE-2026-121408, CVE-2026-121405).
Low-severity issues, such as CVE-2026-121411, involve improper bounds checking in RDPGFX PDUs, which could lead to client aborts. While less severe, these still contribute to the overall attack surface.
All disclosed vulnerabilities affect FreeRDP versions prior to 3.32.2. Users are strongly advised to update to version 3.32.2 or later to mitigate these risks. The comprehensive nature of this batch highlights the importance of timely patching and security updates for the FreeRDP software.
This extensive disclosure underscores the need for continuous security vigilance within the FreeRDP ecosystem. Users should ensure their systems are updated to the latest patched version to protect against potential exploitation of these numerous flaws.