Use-After-Free in FreeRDP Client via RDPGFX ResetGraphics

Executive Summary

CVE-2026-121957 is a use-after-free vulnerability in FreeRDP versions before 3.32.2. It occurs when an RDP server sends a ResetGraphics command while simultaneously sending compressed bitmaps with 32 bpp or higher. This race condition corrupts shared planar buffers, leading to heap corruption, use-after-free, or out-of-bounds read/write operations.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual RDP traffic patterns or crashes in FreeRDP clients. Check FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Monitor logs for segmentation faults or heap corruption errors during RDP sessions. Network traffic analysis may show interleaved ResetGraphics PDUs and bitmap updates from untrusted servers.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code or cause a denial of service on affected FreeRDP clients. The attack requires a malicious RDP server in the ACTIVE state, making users connecting to untrusted servers vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.2 or later. Disable RDP connections to untrusted servers until patched. Implement network monitoring to block suspicious RDP traffic patterns. If using affected versions, avoid connecting to potentially malicious RDP servers to prevent exploitation.

Useful 0 Not Useful 0