CVE-2026-121958

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A heap out-of-bounds write exists in the RDPGFX client. The issue occurs because the delete surface() callback truncates surface hash keys to 16 bits, causing the surface table to become inconsistent. Consequently, the HashTable GetKeys() function writes beyond the boundaries of its allocated key array. A malicious or man-in-the-middle RDP server can trigger this by creating a surfaceId of 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and subsequently sending ENDFRAME or RESETGRAPHICS.

Recommendations Update to version 3.32.2 or later.