CVE-2026-121958

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.

• CWE-122

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m59q-wm7v-mp57Exploit, Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/freerdp-through-3.32.1-heap-out-of-bounds-write-via-rdpgfx-hashtable-getkeysThird Party Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m59q-wm7v-mp57Exploit, Mitigation, Vendor Advisory

Published

Nov 4, 2026

Last Modified

Nov 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-121952FreeRDP before 3.32.2 has an out-of-bounds write in the prox…9.8
• CVE-2026-121953FreeRDP before 3.32.2 has a use-after-free in the client's r…9.8
• CVE-2026-121954FreeRDP before 3.32.2 has a heap out-of-bounds write in the …6.5
• CVE-2026-121955FreeRDP before 3.32.2 contains a use-after-free vulnerabilit…6.5
• CVE-2026-121956FreeRDP before 3.32.2 contains a double free in the WinPR Ke…7.5
• CVE-2026-121957FreeRDP before 3.32.2 contains a use-after-free vulnerabilit…7
• CVE-2026-121959FreeRDP before 3.32.2 contains an infinite loop vulnerabilit…6.5
• CVE-2026-12196HestiaCP panel cronjob feature is affected by a broken acces…8.3
• CVE-2026-121960FreeRDP before 3.32.2 contains a denial of service vulnerabi…7.5
• CVE-2026-121961FreeRDP before 3.32.2 contains a use-after-free vulnerabilit…5.9
• CVE-2026-121962FreeRDP before 3.32.2 contains a heap buffer overflow in tra…8.1
• CVE-2026-121963FreeRDP before 3.32.2 contains a use-after-free vulnerabilit…5.9