PT-2026-136155
CVE-2026-121398
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 4.0
8.2
HighMetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.32.2
Description
A cross-thread use-after-free issue exists in the
freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can trigger this by sending dynamic channel data while the front client is disconnecting, which allows the client thread to read freed ChannelData and causes the proxy process to crash.Recommendations
Update to version 3.32.2 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾