CVE-2026-121964

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A heap-based buffer overflow exists in the RD Gateway RPC client. The issue occurs within the rpc client recv fragment() function, which writes BIND ACK and ALTER CONTEXT RESP fragments into a persistent PDU (Protocol Data Unit) stream. The function incorrectly validates the buffer by checking only the total capacity instead of the remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc hint and frag length values to overwrite client heap memory with attacker-controlled data, potentially leading to a crash or arbitrary code execution.

Recommendations Update to version 3.32.2 or later.