CVE-2026-121958

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.