Quick answers
- Is CVE-2026-121398 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121398 being exploited in the wild.
- How severe is CVE-2026-121398?
- Medium severity, with a CVSS score of 5.9, published 3 November 2026.
- Which products and versions are affected?
- FreeRDP before 3.32.2.
- Is there a fix for CVE-2026-121398?
- Yes: fixed in 3.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121398 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-121398?
- Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.32.2
Technical details
A cross-thread use-after-free exists in the dyn-channel-dump module when a malicious RDP target sends dynamic channel data during front client disconnection. The vulnerability occurs because pf_modules_set_plugin_data() does not clear the module-data table entry when passed a null pointer, allowing the client thread to access freed ChannelData. The attack is triggered by the race between HOOK_TYPE_SERVER_SESSION_END (which deletes the data) and WaitForSingleObject() (which waits for the client thread to finish), requiring a malicious or compromised RDP server and the non-default dyn-channel-dump module to be configured.
Affected products
- FreeRDP FreeRDP before 3.32.2
Timeline
- 2026-10-19: disclosed
- 2026-10-19: patched: Version 3.32.2 released
- 2026-11-03: advisory