CVE-2026-121954
Undergoing Analysis Undergoing Analysis - In Progress

Heap Out-of-Bounds Write in FreeRDP

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR command, to corrupt client heap memory and crash the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121954
EUVD
EUVD-2026-116954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds write flaw in FreeRDP's planar codec. A malicious RDP server can send an oversized ResetGraphics PDU with large dimensions during the handshake, causing buffer allocation to fail. The client commits new dimensions before checking allocation success, leaving the codec in an inconsistent state. Subsequent operations then write to old, smaller buffers using new dimensions, corrupting memory and potentially crashing the client.

Detection Guidance

Monitor FreeRDP versions for 3.32.1 or earlier. Check logs for failed ResetGraphics operations or segmentation faults during RDP sessions. Use network traffic analysis to detect oversized ResetGraphics PDUs (e.g., dimensions like 32766x32766) sent by RDP servers.

Impact Analysis

If exploited, this vulnerability can crash the FreeRDP client due to memory corruption. It requires a malicious RDP server to send specially crafted data, so users connecting to untrusted servers are at risk. The attack may lead to denial-of-service conditions or potential code execution if memory corruption is leveraged further.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later immediately. Disable RDP sessions if possible until patched. Restrict network access to RDP servers to trusted sources only. Monitor for crashes or memory corruption in FreeRDP clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...