CVE-2026-121954

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A heap out-of-bounds write exists in the planar codec. The issue occurs because the freerdp bitmap planar context reset() function commits new dimensions before buffer reallocation succeeds, while a failed ResetGraphics is only logged. A malicious RDP server can exploit this by sending an oversized ResetGraphics PDU followed by a GFX PLANAR command to corrupt client heap memory and cause the client to crash.

Recommendations Update to version 3.32.2 or later.