CVE-2026-121961
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 04, 2026
Vendor
unknown
Description
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.