CVE-2026-121398Medium· 5.9▾ SunlitFreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, let…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.
FreeRDP < 3.32.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23884Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-23883Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-121953Critical· 9.8FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close
CVE-2026-121955High· 7.5FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext
CVE-2026-114042Medium· 6.5FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
CVE-2026-109676High· 8.8FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation