CVE-2026-121957
CVE-2026-121957
8.7
HighPublished:
Last updated:
Source:disclosure@vulncheck.com
Analyzed
Weakness (CWE)
CVSS Vector
v4.0- Attack Vector
- Network
- Attack Complexity
- Low
- Attack Requirements
- None
- Privileges Required
- None
- User Interaction
- None
- Confidentiality (Vulnerable)
- High
- Integrity (Vulnerable)
- None
- Availability (Vulnerable)
- None
- Confidentiality (Subsequent)
- None
- Integrity (Subsequent)
- None
- Availability (Subsequent)
- None
Description
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.
References
disclosure@vulncheck.com
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95gdisclosure@vulncheck.com
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race134c704f-9b21-4f2e-91b3-4a467353bcc0
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g