CVE-2026-121952: buffer overflow in FreeRDP proxy

CVE-2026-121952 describes a critical buffer overflow vulnerability in the FreeRDP proxy, widely deployed for RDP remote access on Linux environments. The flaw resides in bitmap cache v2 handling: when an RDP client connects to the proxy declaring fewer than 5 cell caches, the code accepts the declared value but then accesses the cache array at fixed indices 0-4. This missing validation causes an out-of-bounds write that corrupts heap memory.

The assigned CVSS score is 9.8 (Critical), indicating maximum impact on confidentiality, integrity, and availability of the service. The flaw affects the proxy component exposed to clients on the network, and risks include heap memory corruption, data leakage to the RDP backend, and service crash. The CVE was officially published on NVD on November 4, 2026. No confirmed public exploits are reported at this time, but the simplicity of the trigger condition makes rapid development probable.

Administrators must update FreeRDP to version 3.32.2 or later with maximum priority. Before rollout to production, test the patch in an isolated environment to verify compatibility with local RDP configurations. Verify the complete inventory of all FreeRDP instances in use, paying particular attention to RDP proxies exposed to untrusted clients, and coordinate a rapid and orderly rollout across all systems.