CVE-2026-121952

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description An out-of-bounds write exists in the proxy component due to improper validation of the numCellCaches value in the rdp read bitmap cache v2 capability set() function. While the function only rejects values above 5, the bitmap cache v2 cell array is subsequently accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches during the Confirm Active phase, leading to heap corruption, heap data leakage to the backend, or a system crash.

Recommendations Update to version 3.32.2.