CVE-2026-121953: critical use-after-free in FreeRDP

CVE-2026-121953 concerns a use-after-free vulnerability in the rdpgfx dynamic virtual channel of the FreeRDP client, widely distributed in enterprise environments for remote access and critical infrastructure systems. A malicious RDP server can exploit this defect by creating a channel with duplicate name and different identifier, overwriting the listener's callback without clearing memory references when the channel closes.

The vulnerability has a CVSS score of 9.8 (critical) and was published on November 4, 2026. The impact is immediately critical: FreeRDP client crash or potential arbitrary code execution controlled from a compromised RDP server. Social signals show still-limited awareness (1 post in last 24 hours, 25 interactions). Public distribution of working exploits in monitored repositories is not confirmed.

Security teams and IT administrators must immediately update all FreeRDP clients to version 3.32.2 or later. Inventory installations in sensitive environments (remote access workstations, remote control systems for critical infrastructure) and assign maximum priority to patching. Monitor RDP connection logs for anomalies and, where possible, enforce connection restrictions exclusively to verified and trusted RDP servers.