CVE-2026-121953

Summary

A use-after-free vulnerability in FreeRDP's RDP Graphics Pipeline (rdpgfx) dynamic virtual channel allows a malicious RDP server to overwrite a freed channel callback slot by reusing a channel name with a new ChannelId, then trigger execution through a PDU on the original channel—potentially leading to client crash or arbitrary code execution.

Exploitability

Exploitation requires control of the RDP server (e.g., via compromised or malicious infrastructure), as the attack is initiated server-side during channel setup and teardown; no user interaction or authentication bypass is needed.

Blast radius

Successful exploitation could lead to full compromise (RCE) of any FreeRDP client connecting to a malicious or compromised RDP server, affecting endpoints ranging from thin clients to workstations running remote desktop sessions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FreeRDP version 3.32.2 or later, which contains the official fix for this use-after-free in the rdpgfx channel handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.