CVE-2026-121952

Summary

FreeRDP before 3.32.2 has an out-of-bounds write in its proxy component due to insufficient validation of the number of bitmap cache v2 cell caches; the code accepts up to 5 but later accesses indices 0–4 unconditionally, leading to heap corruption when fewer than 5 cells are declared by the client.

Exploitability

Exploitation is straightforward for an unauthenticated remote attacker who can connect to the FreeRDP proxy and send a malformed Confirm Active PDU declaring fewer than five cell caches.

Blast radius

Successful exploitation could allow full compromise of the proxy host—including remote code execution, data exfiltration to the backend RDP server, or denial of service—potentially affecting all downstream RDP sessions proxied through it.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade FreeRDP to version 3.32.2 or later, which fixes the validation logic in rdp_read_bitmap_cache_v2_capability_set.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.