Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-121957FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

High 7.5

In plain English

A high-severity race condition in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	freerdp2	no fix listed	DEBIAN-CVE-2026-121957
Debian:13	freerdp3	no fix listed	DEBIAN-CVE-2026-121957
Debian:14	freerdp3	3.32.2+dfsg-1	DEBIAN-CVE-2026-121957

Affected products (as reported)

Vendor	Product	Versions
FreeRDP	FreeRDP	0 – before 3.32.2

Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-xjhw-2r55-m95g) vendor-advisory
VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race third-party-advisory