{"id":"CVE-2026-121964","published":"2026-11-04T16:17:49.683","lastModified":"2026-11-04T19:17:38.040","description":"FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-122"],"vendors":["freerdp"],"products":["freerdp"],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q82v-5wjg-6h57","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-buffer-overflow-via-rpc-client-recv-fragment","tags":["Third Party Advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q82v-5wjg-6h57","tags":["Exploit","Mitigation","Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q82v-5wjg-6h57","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q82v-5wjg-6h57","tags":["Exploit","Mitigation","Vendor Advisory"]}],"hasPoc":true,"ai":null}