Quick answers
- Is CVE-2026-121950 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121950 being exploited in the wild.
- How severe is CVE-2026-121950?
- Medium severity, with a CVSS score of 6.5, published 4 November 2026.
- Which products and versions are affected?
- FreeRDP before 3.32.2.
- Is there a fix for CVE-2026-121950?
- Yes: fixed in 3.32.2. Until then: Disable the RDPGFX dynamic virtual channel if remote connections are only to trusted servers, or restrict RDP connections to known legitimate servers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121950 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-121950?
- Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.32.2
Disable the RDPGFX dynamic virtual channel if remote connections are only to trusted servers, or restrict RDP connections to known legitimate servers.
Technical details
The gdi_CreateSurface function in the RDPGFX virtual channel handler does not validate that the product of surface width and height multiplied by bytes-per-pixel will not overflow before calling winpr_aligned_calloc. When a malicious server sends width and height of 32766, the rounding to 32768 and subsequent multiplication (131088 bytes per row × 32768 rows) causes integer overflow on 32-bit systems, allocating only 524 KiB instead of 4+ GiB, leading to heap buffer overflow during initialization. On 64-bit systems, the full allocation succeeds but wastes ~4 GiB, causing denial of service.
Affected products
- FreeRDP before 3.32.2
Timeline
- 2026-10-20: disclosed
- 2026-11-04: advisory