CVE-2026-121957
Description
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a race condition in the client by concurrently transmitting graphics reset commands alongside compressed bitmap data. This flaw leads to a use-after-free condition or out-of-bounds memory access on shared graphics decoding buffers. Consequently, an attacker can corrupt client memory, potentially causing the client application to crash resulting in a Denial of Service (DoS) or exposing sensitive memory contents.
Statement
This flaw is rated as an Important severity because an untrusted endpoint can compromise client memory integrity and potentially execute arbitrary code with the privileges of the user running the session. A client system is vulnerable only when initiating a connection to an attacker-controlled remote desktop server that transmits conflicting display pipeline instructions. Although triggering this synchronization defect requires specific timing and client-initiated interaction, successful exploitation directly compromises the security boundaries of the client system.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to synchronize access and establish mutual exclusion between the drdynvc RDPGFX ResetGraphics handler and the main thread planar bitmap decoder on shared planar buffers: upgrade to FreeRDP 3.32.2+ (or the fixed Freerdp builds), which synchronizes the drdynvc ResetGraphics path and planar decode routines sharing the planar context to prevent concurrent buffer reallocations during active decoding, closing concurrent RDPGFX ResetGraphics messages and compressed planar bitmap updates. Until patched, this is a concern on FreeRDP client installations connecting to remote RDP servers across any platform, so Restrict outbound RDP client connections to trusted, verified servers and block connections to unknown or untrusted remote desktop endpoints. As a compensating measure, Enable Address Space Layout Randomization to randomize FreeRDP process memory layout and hinder reliable code execution from heap corruption and Enable glibc safe-linking and heap metadata protection to impede heap manipulation and tcache corruption during planar buffer use-after-free exploitation. These controls limit blast radius and contain exploitation, but they do not fix the underlying race condition use-after-free defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | None |
| Availability Impact | High | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
