CVE-2026-121957FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

Açıklama

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-xjhw-2r55-m95g) vendor-advisoryExploitMitigationVendor Advisory
• VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race third-party-advisoryThird Party Advisory