CVE-2026-121957 FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

What is CVE-2026-121957?

CVE-2026-121957 is a high-severity vulnerability in FreeRDP, published on 4 Nov 2026.

Official description

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

Weakness: CWE-362

Which versions are affected by CVE-2026-121957?

It affects 1 product.

Products include FreeRDP.

How do I fix CVE-2026-121957?

Upgrade to a fixed version.

Is CVE-2026-121957 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-121957 exists.

Other vulnerabilities in FreeRDP

• CVE-2024-32658 FreeRDP ExtractRunLengthRegular* out of bound read Critical 9.8
• CVE-2024-32659 freerdp_image_copy out of bound read Critical 9.8
• CVE-2024-32039 FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data Critical 9.8
• CVE-2024-32041 FreeRDP OutOfBound Read in zgfx_decompress_segment Critical 9.8
• CVE-2024-32458 FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle Critical 9.8

All FreeRDP vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-121957, GHSA-r7gw-v2vh-25mh, GHSA-xjhw-2r55-m95g, UBUNTU-CVE-2026-121957.