CVE-2026-121952 in FreeRDP
Summary
by MITRE • 11/04/2026
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical out-of-bounds write condition located within the Remote Desktop Protocol proxy implementation. This flaw stems from an insufficient validation mechanism during the initialization of bitmap cache capabilities. Specifically, when processing the rdp_read_bitmap_cache_v2_capability_set function, the software only enforces a lower bound check that rejects numCellCaches values exceeding five. However, it fails to validate whether the declared number of cell caches is sufficient for subsequent operations or correctly bounds the array access logic. The internal bitmap cache v2 implementation relies on fixed indices ranging from zero through four, assuming that at least five cells are available and properly allocated based on client declarations.
When a malicious client connects to this proxy service, it can exploit this logical discrepancy by declaring fewer than five cell caches in its Confirm Active message. This action triggers the allocation of an undersized memory buffer or leaves internal pointers misaligned relative to expected access patterns. As the system proceeds with standard RDP operations that involve writing bitmap data into these cache cells, the code attempts to write to indices that exceed the allocated bounds due to the mismatch between declared capacity and actual array sizing logic. This results in a heap-based out-of-bounds write, where memory adjacent to the intended buffer is overwritten with unintended data.
The operational impact of this vulnerability is severe, encompassing multiple vectors of exploitation including remote code execution potential through heap corruption, denial of service via application crash, and sensitive information disclosure. The heap corruption can corrupt internal program structures or function pointers, potentially allowing an attacker to execute arbitrary code on the proxy server if they can control the overwritten memory contents. Furthermore, because the write operation extends beyond the allocated buffer boundaries, it may inadvertently read from or overwrite adjacent memory regions that contain other application data. This leads to heap data leakage, where sensitive information such as authentication tokens, internal state variables, or even parts of the backend communication stream could be exposed to the client side through subsequent reads or error messages generated by the corrupted heap structure.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, which describes writing data outside the boundaries of allocated memory. It also relates closely to CWE-134: Use of Externally-Controlled Format String if format strings are involved in subsequent processing, though the primary vector is memory corruption. In terms of adversary tactics, this flaw facilitates exploitation consistent with ATT&CK technique T1059: Command and Scripting Interpreter or T1203: Exploitation for Client Execution, as a compromised proxy could be used to pivot attacks into internal networks by executing code on the intermediary host that trusts connections from various clients.
Mitigation strategies must prioritize immediate patching of FreeRDP to version 3.32.2 or later, where this validation logic has been corrected to properly enforce both upper and lower bounds for numCellCaches and ensure array access remains within allocated limits. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict RDP proxy connections to trusted clients only, reducing the attack surface. Additionally, deploying intrusion detection systems capable of identifying anomalous heap behavior or malformed RDP packets can provide a layer of defense against exploitation attempts while patching efforts are underway. Regular security audits focusing on input validation in protocol parsers are essential to prevent similar logical flaws from persisting in network-facing services.