CVE-2026-121954
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 04, 2026
Vendor
unknown
Description
FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR command, to corrupt client heap memory and crash the client.