Use-after-free in FreeRDP - CVE-2026-121961
Published: November 10, 2026 / Updated: November 11, 2026
Vulnerability identifier: #VU164440
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121961
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing the FreeRDP proxy process.
The vulnerability exists due to use-after-free in the proxy DRDYNVC tracker when drdynvc interception permits a backend thread to free a channel context still used by the front thread. A remote attacker can control an RDP target server and repeatedly send CREATE_REQUEST_PDU messages reusing an active channel identifier during concurrent DATA traffic from an authenticated front session to trigger the race and crash the proxy.
Affected software
FreeRDP
How to mitigate CVE-2026-121961
Install security update from vendor's website.
FreeRDP - update to 3.32.2