CVE-2026-121963
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 04, 2026
Vendor
unknown
Description
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.