External risk intelligence

FreeRDP Proxy Out-of-Bounds Write Affects Bitmap Cache Capability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-121952

This vulnerability affects the FreeRDP proxy component. Proxies, gateways, and remote access services are frequently deployed as internet-facing or edge services to facilitate remote connectivity, making them commonly reachable from the public internet in standard network configurations.

Out-of-bounds Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability has been identified in FreeRDP, a widely used remote desktop protocol client, affecting its proxy functionality. This issue could allow an unauthenticated client to disrupt the service or potentially expose sensitive information residing in memory. The primary concern is to determine if our environment utilizes this specific FreeRDP proxy component, as exploitation could impact our remote access capabilities.

A remote connection issue could leak memory or crash.
Leadership should monitor for proxy usage and impact.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker could target the FreeRDP proxy, which is often exposed to the internet for remote access. By connecting to this proxy and manipulating the bitmap cache information, an attacker could trigger a vulnerability. Successful exploitation could lead to the corruption or leakage of heap data, or cause the service to crash, potentially disrupting operations.

External access to the proxy.
Crafted client connection during confirmation.
Heap corruption or denial of service.

Live Threat

Current exploitation, exposure, and threat context

A client connecting to a FreeRDP proxy could trigger an out-of-bounds write by sending specific data, potentially leading to heap corruption, data leakage to the backend, or a service crash. This vulnerability could affect systems running FreeRDP proxy when processing malicious client connections.

Proxy service integrity
Malicious client input to proxy
Service crash or data leakage

Operational Fix

Recommended remediation, mitigation, and detection steps

The FreeRDP proxy component is likely managed by infrastructure or platform teams responsible for remote access services. The immediate first step is to identify all instances of the affected FreeRDP proxy, determine their exposure to untrusted networks, and confirm their business criticality to prioritize remediation efforts.

Infrastructure or platform teams own the issue.
Verify proxy exposure and business criticality.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeRDP and its proxy component?

FreeRDP is a free, open-source software suite that implements the Remote Desktop Protocol (RDP). It allows users to connect to remote desktop environments across different operating systems. The proxy component acts as an intermediary or gateway, relaying connection traffic between clients and backend RDP servers to facilitate secure or managed remote access.

What does this CVE-2026-121952 vulnerability mean?

This is an out-of-bounds write vulnerability, classified as CWE-787. It occurs because the proxy fails to properly validate the number of bitmap caches declared by a connecting client. When the software expects a specific range but processes an unexpected value, it attempts to write data into restricted memory areas, potentially leading to heap corruption or unauthorized data access.

How does an attacker trigger this bug?

An attacker triggers the vulnerability by initiating a connection to a vulnerable FreeRDP proxy and sending a crafted 'Confirm Active' message during the session setup. The bug occurs when the client declares fewer than five bitmap cell caches. If the client provides a standard, valid configuration that conforms to the expected limits, the trigger condition is not met.

Is my network at risk from this FreeRDP issue?

If you run a FreeRDP proxy, your risk depends on network placement. According to Halo Surface Signal, these proxies are often deployed as internet-facing or edge services to enable remote access, which makes them highly reachable by external threats. Systems operating solely within a private, restricted network face a lower probability of direct external attack.

What should I do to address CVE-2026-121952?

The first step is to locate all instances of the FreeRDP proxy within your infrastructure. Coordinate with your platform or IT teams to determine which proxies are exposed to untrusted networks. Once identified, evaluate these systems based on their business criticality and prepare to update to version 3.32.2 or later to remediate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.