CVE-2026-121408

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A use-after-free issue exists in the urbdrc USB redirection channel. This occurs because the FindChannelById() function returns a channel pointer without a reference, and the control-channel close path fails to acquire the device manager's loading lock. A malicious RDP server can trigger this by sending a control-channel CLOSE REQUEST while the client is announcing a USB device, which frees the channel before the announcement thread reads channel->Write, leading to a client crash.

Recommendations Update to version 3.32.2 or later.