CVE-2026-121961
Undergoing Analysis Undergoing Analysis - In Progress

Use-After-Free in FreeRDP Proxy via DRDYNVC Channel

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121961
EUVD
EUVD-2026-116961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in FreeRDP before version 3.32.2. It occurs in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU messages for an active channel ID, racing against front DATA handling to free a borrowed context and crash the proxy process.

Detection Guidance

Monitor FreeRDP proxy logs for SIGSEGV crashes or ASan heap-use-after-free errors. Check for repeated DRDYNVC CREATE_REQUEST_PDU messages from target servers. Use network traffic analysis tools like Wireshark to inspect RDP channel traffic for abnormal CREATE_REQUEST_PDU sequences.

Impact Analysis

The primary impact is denial of service for the proxy process, causing it to crash with a SIGSEGV or ASan-detected heap-use-after-free. This requires an authenticated front session with active dynamic-channel data and proxy drdynvc interception. The attacker does not need proxy credentials.

Mitigation Strategies

Upgrade FreeRDP proxy to version 3.32.2 or later. Disable DRDYNVC channel interception in the proxy configuration if not required. Implement network segmentation to limit RDP traffic exposure. Monitor proxy processes for crashes and restart them if affected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...