FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964)
FreeRDP before 3.32.2 (client, server and freerdp-proxy)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
FreeRDP, the open-source RDP client, server and proxy library used by Remmina, GNOME Connections and many Linux desktops and thin clients, shipped 3.32.2 as a security release that hardens it against malicious client and server messages, with more than 40 GitHub advisories. CVE records for them were published on November 3 and 4. CVE-2026-121392 (CVSS 4.0 9.1) lets a man-in-the-middle holding a certificate from any client-trusted CA bypass server identity checks in tls_verify_certificate and intercept RDP sessions. CVE-2026-121953 (9.3) is a use-after-free in the client's rdpgfx channel that a malicious RDP server can trigger to crash the client or potentially execute code, and CVE-2026-121952 (9.3) is an out-of-bounds write in freerdp-proxy reachable by a connecting client. The rest are heap overflows, use-after-frees, a Kerberos double free and denial-of-service bugs, most needing the user to connect to a malicious or compromised server. Update FreeRDP to 3.32.2 or your distribution's patched package.
Why this severity: VulnCheck CVSS 4.0 scores 7.1 to 9.3; most bugs need the victim to connect to a malicious RDP server, CVE-2026-121392 needs an on-path attacker with a certificate from a trusted CA
- Started
- Nov 4, 2026
Affected
- FreeRDP before 3.32.2
Fixed in
- FreeRDP 3.32.2
Timeline3
CVE records CVE-2026-121950 to CVE-2026-121964 are published for heap overflows, use-after-frees and denial-of-service bugs fixed in 3.32.2.
CVE-2026-121392, a certificate identity validation bypass in tls_verify_certificate, is published.
FreeRDP releases 3.32.2 as a regression, bugfix and security release listing more than 40 GitHub security advisories.
Advisories7
- FreeRDP 3.32.2 release notesFreeRDP
- Certificate identity validation bypass via tls_verify_certificate (GHSA-jq25-3374-4262)FreeRDP
- Use-after-free via rdpgfx dynamic virtual channel close (GHSA-6wqx-rv3q-vcxp)FreeRDP
- Proxy out-of-bounds write via bitmap cache v2 capability (GHSA-xc85-4mqc-xgcx)FreeRDP
- Heap out-of-bounds write via RDPGFX HashTable_GetKeys (GHSA-m59q-wm7v-mp57)FreeRDP
- CVE-2026-121953CVE.org
- CVE-2026-121392NVD
Get an email when a new major security incident drops. No spam, unsubscribe any time.
