External risk intelligence

FreeRDP Use-After-Free in RDPGFX Dynamic Virtual Channel

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-121953

The vulnerability exists in the FreeRDP client-side implementation of a virtual channel. While a malicious server could theoretically trigger this, RDP clients are typically used to connect to known, trusted, or internally managed servers rather than arbitrary public internet hosts, making broad public-facing exploitation of this specific client-side interface uncommon.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in FreeRDP, a technology used for Remote Desktop Protocol client functionality. This issue, if exploited, could allow a malicious server to crash the client or potentially execute code, posing a risk to systems connecting to untrusted RDP servers. The primary concern is confirming whether our environment utilizes the affected component and is exposed to such connections.

A flaw exists in how client connections are managed.
Understand potential risks when connecting to unknown servers.
Assess exposure and confirm system relevance.

Attack Path

How an attacker could exploit the issue

An attacker, likely controlling an RDP server, could exploit this vulnerability by establishing a connection and then carefully manipulating the dynamic virtual channel communication. This involves opening and closing a specific type of channel in a way that misuses the client's handling of channel closures, potentially leading to a crash or code execution on the connected client.

Requires attacker to control RDP server.
Triggers when client processes a closed channel.
Risk of client crash or code execution.

Live Threat

Current exploitation, exposure, and threat context

A malicious RDP server could potentially cause a FreeRDP client to crash or execute arbitrary code by exploiting a use-after-free vulnerability in the client's handling of the rdpgfx dynamic virtual channel. This could occur when a server repeatedly opens and closes a specially crafted channel, leading to unexpected behavior in the client when it attempts to process further data.

Client application crashes.
Code execution via crafted channel.
Disruption of remote desktop sessions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FreeRDP client is the vulnerable component. Ownership likely resides with teams managing remote access infrastructure, potentially endpoint security or desktop engineering teams, depending on how clients are deployed and managed. The first practical move is to identify all instances of FreeRDP clients, determine their exposure to untrusted RDP servers, and assess their criticality. Remediation planning should then prioritize the most exposed and critical systems.

Identify FreeRDP client owners.
Verify client exposure to untrusted servers.
Plan client updates based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeRDP?

FreeRDP is a free, open-source implementation of the Remote Desktop Protocol (RDP). Developers and organizations use it to build client applications that allow users to connect to and control remote desktop environments. It supports various features like clipboard redirection, audio, and the RDPGFX graphics pipeline, which handles complex display tasks during remote sessions.

What does CVE-2026-121953 mean by a use-after-free weakness?

This vulnerability is classified as CWE-416, a use-after-free error. It occurs when a program continues to use a memory address after it has been freed. In this specific case, the client fails to clear a reference to a closed virtual channel. Because the memory is still being accessed, a malicious server can manipulate that stale reference to disrupt the program or force it to run unintended code.

How does an attacker trigger this RDPGFX vulnerability?

An attacker must control a malicious RDP server to which a victim connects. The exploit relies on opening and closing a duplicate-name dynamic virtual channel to overwrite a callback slot. If the client does not clear this slot properly during the close operation, the attacker can send specific data to the original channel to trigger the memory error. Simply connecting to a benign or trusted server does not activate this flaw.

Do I need to worry about this if I use FreeRDP?

Halo Surface Signal indicates this is unlikely to be broadly exploited because it requires a user to connect to an untrusted RDP server. The vulnerability exists entirely within the client-side software. If your systems only connect to known, internally managed, or highly trusted RDP infrastructure, the risk of encountering an attacker capable of triggering this specific RDPGFX bug is significantly reduced.

When should I update my FreeRDP software?

You should prioritize updates if your environment requires users to connect to third-party or unknown RDP servers. Start by auditing your infrastructure to locate all instances of the FreeRDP client. Once identified, plan to move to version 3.32.2 or later, which resolves the memory handling flaw, focusing first on machines that frequently establish remote connections outside of your managed network.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.