Heap Out-of-Bounds Write in FreeRDP

Executive Summary

CVE-2026-121958 is a heap out-of-bounds write flaw in FreeRDP versions up to 3.32.1. It occurs in the RDPGFX client due to a bug in the delete_surface callback that truncates surface hash keys to 16 bits. This causes the surface table to become inconsistent, allowing HashTable_GetKeys to write past its allocated key array. An attacker can exploit this by creating a surface with ID 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS commands.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual RDPGFX channel activity. Check FreeRDP versions with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Inspect network traffic for repeated DELETESURFACE PDUs or ENDFRAME/RESETGRAPHICS commands targeting surface ID 0xFFFF. Enable verbose logging in FreeRDP with '-log-level DEBUG' to capture protocol anomalies.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious or man-in-the-middle RDP server to crash the FreeRDP client or potentially execute arbitrary code on the affected system. Users running vulnerable FreeRDP versions may experience application crashes or remote code execution if they connect to a compromised RDP server.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.22.2 or later immediately. If upgrading is not possible, disable the RDPGFX channel by removing 'rdpgfx' from the FreeRDP configuration or command line. Restrict RDP access via firewalls to trusted sources only. Monitor for suspicious RDP server behavior, such as repeated surface deletions or channel resets.

Useful 0 Not Useful 0