CVE-2026-121953
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Nov 04, 2026
Vendor
unknown
Description
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.