CVE-2026-121952
Undergoing Analysis Undergoing Analysis - In Progress

Out-of-Bounds Write in FreeRDP Proxy

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121952
EUVD
EUVD-2026-116952

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.32.2 has an out-of-bounds write vulnerability in its proxy component. The issue occurs when handling the Bitmap Cache v2 Capability. The proxy only rejects numCellCaches values above 5 but later accesses a fixed array of indices 0 through 4. A malicious client can declare fewer than five cell caches, causing heap corruption, data leakage, or crashes.

Detection Guidance

Check FreeRDP version with 'xfreerdp --version' or 'freerdp-proxy --version'. Monitor proxy logs for crashes or memory corruption during RDP sessions. Inspect network traffic for Confirm Active messages with numCellCaches values below 5.

Impact Analysis

This vulnerability can lead to heap corruption, heap data leakage to backend systems, crashes, or null pointer dereferences. Exploiting it with numCellCaches set to 0 causes a deterministic crash. Other values (1-3) with persistent keys enabled also cause crashes due to out-of-bounds reads.

Mitigation Strategies

Upgrade FreeRDP proxy to version 3.32.2 or later immediately. Block untrusted RDP clients until patched. Monitor for suspicious connections to proxy ports. Disable proxy if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...