CVE-2026-121957FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

8.7 HIGHEPSS 0.24%Not in KEVNVD: Analyzed

Last updated: 2026-11-05 19:23 UTC

OverviewCVSS details

8.7HIGHCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Analyzed
Published: Nov 4, 2026
Assigner: VulnCheck

Affected

FreeRDP (FreeRDP)

Versions: before 3.32.2
Fixed in: 3.32.2

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation poc · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 7

0.24%chance of exploitation in 30 days

Higher than 15.70% of CVEs

CVSS 4.0 · VulnCheck (CNA)

8.7High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: None
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulnCheck (CNA)

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

CVSS 3.1 · NVD

7.0High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: Low
Integrity impact: Low
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.7	HIGH	4.0VulnCheck (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5	HIGH	3.1VulnCheck (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.0	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Details

CVE ID: CVE-2026-121957
Status: Analyzed
Assigner (CNA): VulnCheck
Published: Nov 4, 2026
Last modified: 2026-11-05 19:23 UTC
Weaknesses: CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:50 UTC.