# FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964) · pwn.watch

> FreeRDP, the open-source RDP client, server and proxy library used by Remmina, GNOME Connections and many Linux desktops and thin clients, shipped 3.32.2 as a security release that hardens it against malicious client and server messages, with more than 40 GitHub advisories. CVE records for them were published on November 3 and 4. CVE-2026-121392 (CVSS 4.0 9.1) lets a man-in-the-middle holding a certificate from any client-trusted CA bypass server identity checks in tls_verify_certificate and intercept RDP sessions. CVE-2026-121953 (9.3) is a use-after-free in the client's rdpgfx channel that a malicious RDP server can trigger to crash the client or potentially execute code, and CVE-2026-121952 (9.3) is an out-of-bounds write in freerdp-proxy reachable by a connecting client. The rest are heap overflows, use-after-frees, a Kerberos double free and denial-of-service bugs, most needing the user to connect to a malicious or compromised server. Update FreeRDP to 3.32.2 or your distribution's patched package.

Page: https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves · generated 2026-11-04T18:43:52.585Z

## Status
- Severity: high · status: live · patch: patched
- Product: FreeRDP before 3.32.2 (client, server and freerdp-proxy)
- Started: 2026-11-04
- CVEs: CVE-2026-121392, CVE-2026-121950, CVE-2026-121951, CVE-2026-121952, CVE-2026-121953, CVE-2026-121954, CVE-2026-121955, CVE-2026-121956, CVE-2026-121957, CVE-2026-121958, CVE-2026-121959, CVE-2026-121960, CVE-2026-121961, CVE-2026-121962, CVE-2026-121963, CVE-2026-121964
- Affected: FreeRDP before 3.32.2
- Fixed in: FreeRDP 3.32.2

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves/feed.xml
- JSON Feed: https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves.json
- This file: https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves/llms.txt

## Updates (newest first)
- 2026-11-04: CVE records CVE-2026-121950 to CVE-2026-121964 are published for heap overflows, use-after-frees and denial-of-service bugs fixed in 3.32.2. (https://www.cve.org/CVERecord?id=CVE-2026-121953)
- 2026-11-03: CVE-2026-121392, a certificate identity validation bypass in tls_verify_certificate, is published. (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262)
- 2026-10-12: FreeRDP releases 3.32.2 as a regression, bugfix and security release listing more than 40 GitHub security advisories. (https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2)

## Fix brief
# Security brief: FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964)

Source: https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves · status: live · severity: high · updated Nov 4, 2026, 15:54 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
FreeRDP, the open-source RDP client, server and proxy library used by Remmina, GNOME Connections and many Linux desktops and thin clients, shipped 3.32.2 as a security release that hardens it against malicious client and server messages, with more than 40 GitHub advisories. CVE records for them were published on November 3 and 4. CVE-2026-121392 (CVSS 4.0 9.1) lets a man-in-the-middle holding a certificate from any client-trusted CA bypass server identity checks in tls_verify_certificate and intercept RDP sessions. CVE-2026-121953 (9.3) is a use-after-free in the client's rdpgfx channel that a malicious RDP server can trigger to crash the client or potentially execute code, and CVE-2026-121952 (9.3) is an out-of-bounds write in freerdp-proxy reachable by a connecting client. The rest are heap overflows, use-after-frees, a Kerberos double free and denial-of-service bugs, most needing the user to connect to a malicious or compromised server. Update FreeRDP to 3.32.2 or your distribution's patched package.

Severity detail: VulnCheck CVSS 4.0 scores 7.1 to 9.3; most bugs need the victim to connect to a malicious RDP server, CVE-2026-121392 needs an on-path attacker with a certificate from a trusted CA

- Product: FreeRDP before 3.32.2 (client, server and freerdp-proxy)
- CVE / advisory ids: CVE-2026-121392, CVE-2026-121950, CVE-2026-121951, CVE-2026-121952, CVE-2026-121953, CVE-2026-121954, CVE-2026-121955, CVE-2026-121956, CVE-2026-121957, CVE-2026-121958, CVE-2026-121959, CVE-2026-121960, CVE-2026-121961, CVE-2026-121962, CVE-2026-121963, CVE-2026-121964

## Affected versions
- FreeRDP before 3.32.2

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- FreeRDP 3.32.2

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 4, 2026: CVE records CVE-2026-121950 to CVE-2026-121964 are published for heap overflows, use-after-frees and denial-of-service bugs fixed in 3.32.2.
- Nov 3, 2026: CVE-2026-121392, a certificate identity validation bypass in tls_verify_certificate, is published.
- Oct 12, 2026: FreeRDP releases 3.32.2 as a regression, bugfix and security release listing more than 40 GitHub security advisories.

## Advisories
- [FreeRDP 3.32.2 release notes](https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2) (FreeRDP)
- [Certificate identity validation bypass via tls_verify_certificate (GHSA-jq25-3374-4262)](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262) (FreeRDP)
- [Use-after-free via rdpgfx dynamic virtual channel close (GHSA-6wqx-rv3q-vcxp)](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp) (FreeRDP)
- [Proxy out-of-bounds write via bitmap cache v2 capability (GHSA-xc85-4mqc-xgcx)](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xc85-4mqc-xgcx) (FreeRDP)
- [Heap out-of-bounds write via RDPGFX HashTable_GetKeys (GHSA-m59q-wm7v-mp57)](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m59q-wm7v-mp57) (FreeRDP)
- [CVE-2026-121953](https://www.cve.org/CVERecord?id=CVE-2026-121953) (CVE.org)
- [CVE-2026-121392](https://nvd.nist.gov/vuln/detail/CVE-2026-121392) (NVD)

---
Machine-readable: https://pwn.watch/i/freerdp-3-32-2-memory-corruption-cert-bypass-cves.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.