CVE-2026-121952
Description
A flaw was found in FreeRDP. An out-of-bounds write vulnerability exists in freerdp-proxy when processing Bitmap Cache v2 capability sets. The proxy accepts a client-declared numCellCaches value below five and later indexes the bitmap cache cell array at fixed positions 0 through 4. A client that connects to the proxy and completes capability exchange can cause heap corruption, disclosure of adjacent heap contents to the backend server, or a crash of the proxy process.
Statement
This vulnerability is rated Important rather than Critical. A remote client can trigger memory corruption in freerdp-proxy without additional user interaction on the proxy host, but freerdp-proxy is not enabled or exposed by default and must be deliberately deployed. Turning the constrained out-of-bounds write into reliable arbitrary code execution depends on heap layout and a fully established proxy path to a backend server. Confirmed impacts include proxy process crash and potential heap content leakage to the backend. This Important rating aligns with the upstream High severity advisory rather than a Critical network-service compromise on a default Red Hat deployment.
Mitigation
If freerdp-proxy is not required, do not run it. Where proxy use is necessary, restrict listening access to trusted client networks and require client authentication.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce minimum bounds validation on client-declared numCellCaches before allocating the bitmap cache array in freerdp-proxy: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which reject Bitmap Cache v2 capability sets declaring numCellCaches values below five, closing all 2 injection vectors (Crafted Confirm Active PDU declaring numCellCaches below five, Bitmap Cache v2 capability with persistent keys enabled). Until patched, this is a concern on Deployments running the freerdp-proxy component accessible to network clients, so Disable freerdp-proxy if not required, or restrict network access to trusted client networks and enforce client authentication. As a compensating measure, Enable Address Space Layout Randomization to randomize proxy memory layout and hinder reliable heap exploitation, Enforce full RELRO and PIE on the freerdp-proxy binary to prevent Global Offset Table overwrites, and Enable Control Flow Integrity to restrict indirect branch targets to valid functions if heap metadata is corrupted. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds heap write defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Proxy-side flaw: remote client can reach freerdp-proxy without UI on the proxy host (UI:N). AC:H because reliable code execution from the constrained 4-byte OOB write depends on heap state and a configured proxy/backend session; crash/leak are more readily achieved. C:H for heap disclosure to backend, I:H for heap corruption, A:H for proxy crash. Rated Important (8.1), not Critical: freerdp-proxy is not default-on and upstream GHSA is High.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
