FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964) ยท updates https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves FreeRDP, the open-source RDP client, server and proxy library used by Remmina, GNOME Connections and many Linux desktops and thin clients, shipped 3.32.2 as a security release that hardens it against malicious client and server messages, with more than 40 GitHub advisories. CVE records for them were published on November 3 and 4. CVE-2026-121392 (CVSS 4.0 9.1) lets a man-in-the-middle holding a certificate from any client-trusted CA bypass server identity checks in tls_verify_certificate and intercept RDP sessions. CVE-2026-121953 (9.3) is a use-after-free in the client's rdpgfx channel that a malicious RDP server can trigger to crash the client or potentially execute code, and CVE-2026-121952 (9.3) is an out-of-bounds write in freerdp-proxy reachable by a connecting client. The rest are heap overflows, use-after-frees, a Kerberos double free and denial-of-service bugs, most needing the user to connect to a malicious or compromised server. Update FreeRDP to 3.32.2 or your distribution's patched package. en Wed, 04 Nov 2026 00:00:00 GMT FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964): CVE records CVE-2026-121950 to CVE-2026-121964 are published for heap overflows, use-after-frees and denial-of-service bugs fixed in 3.32.2. https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves#2026-11-04-f6ff189b Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-121953">Source</a></p> FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964): CVE-2026-121392, a certificate identity validation bypass in tls_verify_certificate, is published. https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves#2026-11-03-90574b0f Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262">Source</a></p> FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964): FreeRDP releases 3.32.2 as a regression, bugfix and security release listing more than 40 GitHub security advisories. https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves#2026-10-12-1e0773ec Mon, 12 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2">Source</a></p>