CVE-2026-121958 in FreeRDP
Summary
by MITRE • 11/04/2026
FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in FreeRDP versions up to 3.32.1 represents a critical heap-based buffer overflow within the Remote Desktop Graphics (RDPGFX) client implementation. This flaw stems from an improper handling of surface identifiers during the lifecycle management of graphical surfaces, specifically triggered by the delete_surface callback function. The core technical deficiency lies in the truncation of surface hash keys to sixteen bits when they are stored or processed for deletion purposes. In a properly implemented system, these identifiers should maintain their full integrity to ensure accurate mapping within internal data structures such as hash tables used for tracking active surfaces and their associated resources. By artificially limiting the key size to 16 bits, the application creates a scenario where distinct surface IDs may collide in the hash table or fail to map correctly to their original allocated memory blocks. This inconsistency disrupts the logical relationship between the client's internal state and the actual memory allocations managed by the operating system.
The operational impact of this flaw is severe because it allows for arbitrary heap out-of-bounds writes, which can lead to application crashes, data corruption, or potentially remote code execution depending on the specific memory layout and exploitation techniques employed by an attacker. The attack vector requires a malicious or man-in-the-middle RDP server that has established a connection with the vulnerable FreeRDP client. To trigger this vulnerability, the adversary must first create a surface using the identifier 0xFFFF, which is significant because it represents the maximum value for a sixteen-bit unsigned integer. Following this creation step, the attacker closes the RDPGFX channel and then sends repeated DELETESURFACE Protocol Data Units (PDUs). These PDUs instruct the client to remove specific surfaces from its tracking mechanisms. Due to the truncation bug, these deletion requests do not correctly reference or clear the original surface entries in the hash table, leaving stale pointers or inconsistent states within the data structure.
Subsequently, when the attacker sends ENDFRAME or RESETGRAPHICS PDUs, the client attempts to process frame completion or graphics reset operations that involve iterating over or accessing keys from the corrupted hash table. Specifically, the HashTable_GetKeys function is invoked to retrieve a list of surface identifiers for cleanup or synchronization purposes. Because the internal state has been compromised by the previous inconsistent deletions and truncation errors, this function attempts to write past the bounds of its allocated key array. This out-of-bounds write overwrites adjacent memory regions on the heap, which may contain critical control data such as function pointers, object headers, or other security-sensitive information. Such memory corruption is a classic precursor to exploitation techniques that aim to hijack program execution flow or escalate privileges within the context of the running application.
From a classification perspective, this vulnerability aligns with CWE-122, which denotes heap-based buffer overflow, and specifically relates to improper input validation leading to inconsistent internal states. In terms of adversary tactics, it falls under MITRE ATT&CK technique T1059, Command and Scripting Interpreter, if the resulting code execution is leveraged for further compromise, or more broadly within lateral movement and persistence mechanisms that rely on exploiting remote services. The requirement for a man-in-the-middle position highlights that this vulnerability primarily affects scenarios where network traffic can be intercepted or spoofed between the client and server, emphasizing the importance of secure channel configurations in RDP deployments.
Mitigation strategies must focus on immediate patching to version 3.32.1 or later, where the truncation bug has been addressed by ensuring that surface hash keys are handled with their full bit-width integrity during all lifecycle operations including creation, deletion, and cleanup. Administrators should also enforce strict network segmentation to prevent unauthorized devices from acting as man-in-the-middle proxies for RDP traffic. Additionally, implementing mutual authentication mechanisms such as Network Level Authentication (NLA) can reduce the attack surface by ensuring that only verified servers can establish connections with the client. Regular security audits of remote desktop configurations and keeping all FreeRDP components updated are essential practices to maintain resilience against this class of memory corruption vulnerabilities.