# CVE-2026-121952

Out-of-bounds write in FreeRDP proxy allows heap corruption and data leakage.

- Page: https://www.vulneraibility.com/cve/CVE-2026-121952
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.50% (percentile 43.2)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2026-11-04)
- Weakness: CWE-787
- Also known as: GHSA-xc85-4mqc-xgcx
- Published: 2026-11-04

## Affected versions

- FreeRDP: affected < 3.32.2; fixed in 3.32.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote client to FreeRDP proxy can trigger heap OOB write causing heap corruption, data leakage, crash, and potential remote code execution.

## Action

Immediate action required

## Recommendation

Upgrade to FreeRDP 3.32.2+ and restrict/untrusted client access to proxies.

## References

- [advisory] https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xc85-4mqc-xgcx
- [advisory] https://www.vulncheck.com/advisories/freerdp-before-3.32.2-proxy-out-of-bounds-write-via-bitmap-cache-v2-capability

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.