{
  "fix": "freerdp-proxy-modules 3.32.2\u002Bdfsg-0ubuntu0.26.04.1",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-freerdp-proxy-modules-3.32.2-dfsg-0ubuntu0.26.04.1",
  "summary": "freerdp-proxy-modules 3.32.2\u002Bdfsg-0ubuntu0.26.04.1, released November 11, 2026, fixes 27 CVEs in freerdp-proxy-modules. None of them is reported as exploited. Patch Radar priority: High.",
  "platform": "linux",
  "type": "package",
  "title": "freerdp-proxy-modules 3.32.2\u002Bdfsg-0ubuntu0.26.04.1 for Ubuntu 26.04.1 LTS (resolute)",
  "released": "2026-11-11T00:25:07Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2026-121386, high severity",
  "supported": true,
  "cveCount": 27,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.00383,
  "maxCvss": 7.5,
  "appliesTo": [
    {
      "product": "freerdp-proxy-modules",
      "productUrl": "https://patchblox.com/security/product/linux/freerdp-proxy-modules",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "3.32.2\u002Bdfsg-0ubuntu0.26.04.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-121386",
      "url": "https://patchblox.com/security/cve/CVE-2026-121386",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR\u0027s winpr_read_png_from_buffer() and winpr_co...",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.5,
      "epss": 0.00267,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121404",
      "url": "https://patchblox.com/security/cve/CVE-2026-121404",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP c...",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00383,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121412",
      "url": "https://patchblox.com/security/cve/CVE-2026-121412",
      "title": "freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets c...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00383,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121393",
      "url": "https://patchblox.com/security/cve/CVE-2026-121393",
      "title": "freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abor...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00358,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121409",
      "url": "https://patchblox.com/security/cve/CVE-2026-121409",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated pee...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00329,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121396",
      "url": "https://patchblox.com/security/cve/CVE-2026-121396",
      "title": "freerdp3: FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_rea...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00317,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121401",
      "url": "https://patchblox.com/security/cve/CVE-2026-121401",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTEN...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00317,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121407",
      "url": "https://patchblox.com/security/cve/CVE-2026-121407",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server\u0027s remdesk_server_thread that al...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00314,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121388",
      "url": "https://patchblox.com/security/cve/CVE-2026-121388",
      "title": "freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP...",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.0031,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121400",
      "url": "https://patchblox.com/security/cve/CVE-2026-121400",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a maliciou...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0031,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121389",
      "url": "https://patchblox.com/security/cve/CVE-2026-121389",
      "title": "freerdp3: FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicio...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00307,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121405",
      "url": "https://patchblox.com/security/cve/CVE-2026-121405",
      "title": "freerdp3: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious s...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00286,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121397",
      "url": "https://patchblox.com/security/cve/CVE-2026-121397",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RD...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0027,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121399",
      "url": "https://patchblox.com/security/cve/CVE-2026-121399",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gat...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00269,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121394",
      "url": "https://patchblox.com/security/cve/CVE-2026-121394",
      "title": "freerdp3: FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious se...",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121402",
      "url": "https://patchblox.com/security/cve/CVE-2026-121402",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xf...",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121395",
      "url": "https://patchblox.com/security/cve/CVE-2026-121395",
      "title": "freerdp3: FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose Win...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121398",
      "url": "https://patchblox.com/security/cve/CVE-2026-121398",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump modu...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0025,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121387",
      "url": "https://patchblox.com/security/cve/CVE-2026-121387",
      "title": "freerdp3: FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows mal...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121391",
      "url": "https://patchblox.com/security/cve/CVE-2026-121391",
      "title": "freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close p...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121403",
      "url": "https://patchblox.com/security/cve/CVE-2026-121403",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a trun...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121406",
      "url": "https://patchblox.com/security/cve/CVE-2026-121406",
      "title": "freerdp3: FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_deco...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121410",
      "url": "https://patchblox.com/security/cve/CVE-2026-121410",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fai...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121411",
      "url": "https://patchblox.com/security/cve/CVE-2026-121411",
      "title": "freerdp3: FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALED...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00229,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121408",
      "url": "https://patchblox.com/security/cve/CVE-2026-121408",
      "title": "freerdp3: FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0022,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121392",
      "url": "https://patchblox.com/security/cve/CVE-2026-121392",
      "title": "freerdp3: FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that acce...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00167,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-121390",
      "url": "https://patchblox.com/security/cve/CVE-2026-121390",
      "title": "freerdp3: FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response pa...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00154,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-12T19:57:06Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}