CVE-2026-121952— FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

Quick assessment

Affected

FreeRDP FreeRDP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeRDP 3.32.2 之前的版本在代理组件中存在越界写入漏洞。函数仅拒绝值大于 5 的情况，但随后在访问位图缓存 v2 单元格数组时，却使用了固定的索引 0 至 4。连接至代理的客户端可以在其“确认激活”（Confirm Active）消息中声明少于五个单元格缓存，从而导致堆内存损坏、堆数据泄露至后端服务，或引发程序崩溃。

CVSS 9.8 · Critical Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

Source: CVE Program / CVE List V5

Vulnerability Description

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FreeRDP	FreeRDP	0 ~ 3.32.2	-

II. Public POCs for CVE-2026-121952

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121952

请登录查看更多情报信息。

Other References for CVE-2026-121952 (2)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xc85-4mqc-xgcx vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-proxy-out-of-bounds-write-via-bitmap-cache-v2-capability third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121952

Same Patch Batch · FreeRDP · 2026-11-04 · 15 CVEs total

CVE-2026-121953	9.8 CRITICAL	FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close
CVE-2026-121958	8.8 HIGH	FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys
CVE-2026-121962	8.1 HIGH	FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read
CVE-2026-121951	7.5 HIGH	FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event
CVE-2026-121955	7.5 HIGH	FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext
CVE-2026-121956	7.5 HIGH	FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt
CVE-2026-121957	7.5 HIGH	FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
CVE-2026-121960	7.5 HIGH	FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest
CVE-2026-121964	7.5 HIGH	FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment
CVE-2026-121950	6.5 MEDIUM	FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
CVE-2026-121954	6.5 MEDIUM	FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec
CVE-2026-121959	6.5 MEDIUM	FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame
CVE-2026-121961	5.9 MEDIUM	FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
CVE-2026-121963	5.9 MEDIUM	FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

IV. Related Vulnerabilities

Same product: FreeRDP

Same vendor: FreeRDP

Same weakness: CWE-787