{"id":"CVE-2026-121953","published":"2026-11-04T16:17:47.717","lastModified":"2026-11-04T19:17:35.897","description":"FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp","tags":[]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-dynamic-virtual-channel-close","tags":[]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp","tags":[]}],"exploitRefs":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp","tags":[]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp","tags":[]}],"hasPoc":true,"ai":{"summary":"A use-after-free vulnerability in FreeRDP's RDP Graphics Pipeline (rdpgfx) dynamic virtual channel allows a malicious RDP server to overwrite a freed channel callback slot by reusing a channel name with a new ChannelId, then trigger execution through a PDU on the original channel—potentially leading to client crash or arbitrary code execution.","exploitability":"Exploitation requires control of the RDP server (e.g., via compromised or malicious infrastructure), as the attack is initiated server-side during channel setup and teardown; no user interaction or authentication bypass is needed.","blast_radius":"Successful exploitation could lead to full compromise (RCE) of any FreeRDP client connecting to a malicious or compromised RDP server, affecting endpoints ranging from thin clients to workstations running remote desktop sessions.","remediation":"Upgrade to FreeRDP version 3.32.2 or later, which contains the official fix for this use-after-free in the rdpgfx channel handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","rdp","rce","client-side","vulnerable-client"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:46:06.491Z"}}