CVE-2026-121953

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A use-after-free issue exists in the client's rdpgfx dynamic virtual channel. This occurs when a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which the rdpgfx on close() function frees without clearing. A malicious RDP server can exploit this by opening and closing such a channel and then sending a Protocol Data Unit (PDU) on the original channel, potentially leading to a client crash or arbitrary code execution.

Recommendations Update to version 3.32.2 or later.