FreeRDP
Security incidents tagged FreeRDP. Newest first.
1 FreeRDP incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 21 days (Oct 13–Nov 2)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
FreeRDP 3.32.2 fixes a batch of heap overflows, use-after-frees and a certificate validation bypass (CVE-2026-121392, CVE-2026-121950 to CVE-2026-121964)
FreeRDP, the open-source RDP client, server and proxy library used by Remmina, GNOME Connections and many Linux desktops and thin clients, shipped 3.32.2 as a security release that hardens it against malicious client and server messages, with more than 40 GitHub advisories. CVE records for them were published on November 3 and 4. CVE-2026-121392 (CVSS 4.0 9.1) lets a man-in-the-middle holding a certificate from any client-trusted CA bypass server identity checks in tls_verify_certificate and intercept RDP sessions. CVE-2026-121953 (9.3) is a use-after-free in the client's rdpgfx channel that a malicious RDP server can trigger to crash the client or potentially execute code, and CVE-2026-121952 (9.3) is an out-of-bounds write in freerdp-proxy reachable by a connecting client. The rest are heap overflows, use-after-frees, a Kerberos double free and denial-of-service bugs, most needing the user to connect to a malicious or compromised server. Update FreeRDP to 3.32.2 or your distribution's patched package.
FreeRDP before 3.32.2 (client, server and freerdp-proxy)Since Nov 4, 2026
