freerdp3: FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel w...
CVE-2026-121953 is fixed in freerdp3 on 1 platform by DEBIAN-CVE-2026-121953 (version 3.32.2+dfsg-1), released November 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| freerdp3 · Debian 14 | 3.32.2+dfsg-1 | DEBIAN-CVE-2026-121953 | Nov 5, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.