---
id: CVE-2026-121957
title: FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
summary: >-
  FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows
  malicious RDP servers to corrupt client memory by racing the RDPGFX
  ResetGraphics handler against the planar bitmap decoder. Attackers can send
  ResetGraphics while…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-362
vendor: FreeRDP
product: FreeRDP
affected:
  - FreeRDP < 3.32.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T18:29:39.800968Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:30:03.893Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121957'
references:
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g'
    label: GitHub Security Advisory (GHSA-xjhw-2r55-m95g)
  - url: >-
      https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race
    label: >-
      VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via RDPGFX
      ResetGraphics Race
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-05T21:36:00.491Z'
epss: 0.00244
epssPercentile: 0.15702
---

## Overview

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

## Affected

- `FreeRDP < 3.32.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.