CVE-2026-121963

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A use-after-free issue exists in the asynchronous dynamic rdpsnd channel. A malicious RDP server can trigger access to a freed callback by closing the channel while audio Protocol Data Units (PDUs) are queued. By sending a training PDU and then closing the channel, the playback thread may read the freed callback within the rdpsnd virtual channel write() function, resulting in a client crash.

Recommendations Update to version 3.32.2 or later.