Linux · Ubuntu · Package update · November 11, 2026

freerdp-proxy-modules 3.32.2+dfsg-0ubuntu0.26.04.1: freerdp-proxy-modules 3.32.2+dfsg-0ubuntu0.26.04.1 for Ubuntu 26.04.1 LTS (resolute)

freerdp-proxy-modules 3.32.2+dfsg-0ubuntu0.26.04.1, released November 11, 2026, fixes 27 CVEs in freerdp-proxy-modules. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
27
None rated Critical
Exploited
0
None reported
Highest CVSS
7.5
Base score, 0 to 10
Highest EPSS
0.0038
32nd percentile

Priority of the 27 CVEs

Patch now 0 Urgent 0 High 1 Routine 26

Fixed package versions

ProductReleaseFixed in
freerdp-proxy-modulesUbuntu 26.04.1 LTS (resolute)3.32.2+dfsg-0ubuntu0.26.04.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-121386 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_co...7.5 0.0027 None reported
Routine CVE-2026-121404 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP c...6.5 0.0038 None reported
Routine CVE-2026-121412 freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets c...n/a 0.0038 None reported
Routine CVE-2026-121393 freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abor...n/a 0.0036 None reported
Routine CVE-2026-121409 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated pee...n/a 0.0033 None reported
Routine CVE-2026-121396 freerdp3: FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_rea...n/a 0.0032 None reported
Routine CVE-2026-121401 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTEN...n/a 0.0032 None reported
Routine CVE-2026-121407 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that al...n/a 0.0031 None reported
Routine CVE-2026-121388 freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP...6.5 0.0031 None reported
Routine CVE-2026-121400 freerdp3: FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a maliciou...n/a 0.0031 None reported
Routine CVE-2026-121389 freerdp3: FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicio...n/a 0.0031 None reported
Routine CVE-2026-121405 freerdp3: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious s...n/a 0.0029 None reported
Routine CVE-2026-121397 freerdp3: FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RD...n/a 0.0027 None reported
Routine CVE-2026-121399 freerdp3: FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gat...n/a 0.0027 None reported
Routine CVE-2026-121394 freerdp3: FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious se...6.5 0.0025 None reported
Routine CVE-2026-121402 freerdp3: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xf...6.5 0.0025 None reported
Routine CVE-2026-121395 freerdp3: FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose Win...n/a 0.0025 None reported
Routine CVE-2026-121398 freerdp3: FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump modu...n/a 0.0025 None reported
Routine CVE-2026-121387 freerdp3: FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows mal...n/a 0.0023 None reported
Routine CVE-2026-121391 freerdp3: FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close p...n/a 0.0023 None reported
Routine CVE-2026-121403 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a trun...n/a 0.0023 None reported
Routine CVE-2026-121406 freerdp3: FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_deco...n/a 0.0023 None reported
Routine CVE-2026-121410 freerdp3: FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fai...n/a 0.0023 None reported
Routine CVE-2026-121411 freerdp3: FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALED...n/a 0.0023 None reported
Routine CVE-2026-121408 freerdp3: FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns...n/a 0.0022 None reported
Showing 1 to 25 of 27 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.