# CVE-2026-121961: FreeRDP use-after-free in DRDYNVC tracker race condition

Source: https://junglewise.ai/threats/cve-2026-121961-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121961 · Severity: medium · CVSS 5.9 · Published 2026-11-04

FreeRDP proxy is a remote desktop protocol gateway that relays connections between clients and servers. A malicious RDP server can crash the proxy process by exploiting a race condition in the dynamic virtual channel tracker, causing denial of service. The attack requires an authenticated client session with active dynamic channel data and only affects proxies configured to intercept the drdynvc channel.

Technologies: [FreeRDP Project FreeRDP](https://junglewise.ai/threats/technologies/freerdp-project-freerdp). Vendors: [FreeRDP Project](https://junglewise.ai/threats/vendors/freerdp-project).

## Quick answers

**Is CVE-2026-121961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121961 being exploited in the wild.

**How severe is CVE-2026-121961?** Medium severity, with a CVSS score of 5.9, published 4 November 2026.

**Which products and versions are affected?** FreeRDP Project FreeRDP before 3.32.2.

**Is there a fix for CVE-2026-121961?** Yes: fixed in 3.32.2. Until then: Disable drdynvc channel interception in the proxy configuration or ensure the proxy does not explicitly set Intercept=drdynvc, as the vulnerability only manifests when dynamic channel interception is enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121961 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121961?** Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.2

Disable drdynvc channel interception in the proxy configuration or ensure the proxy does not explicitly set Intercept=drdynvc, as the vulnerability only manifests when dynamic channel interception is enabled.

## Technical details

A use-after-free vulnerability exists in the DRDYNVC channel tracker when the proxy intercepts dynamic virtual channels. An attacker-controlled target server sends duplicate CREATE_REQUEST_PDU messages for the same channel ID, racing against the front-end thread's DATA handling to trigger premature context freeing while borrowed pointers remain in use. The vulnerability manifests as a process crash (SIGSEGV in strlen or ASan abort); no code execution or information disclosure was demonstrated.

## Affected products

- FreeRDP Project FreeRDP before 3.32.2

## Timeline

- 2026-10-20: disclosed
- 2026-11-04: advisory

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c)
- [https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-drdynvc-tracker-race](https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-drdynvc-tracker-race)

## Related threats

- [FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in)
- [FreeRDP infinite loop in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-121959-freerdp-before-3-32-2-contains-an-infinite-loop-vulnerability-in)
- [FreeRDP server denial of service in RDP peer input parsing](https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing)
- [FreeRDP NULL pointer dereference in RDPGFX ResetGraphics](https://junglewise.ai/threats/cve-2026-121402-freerdp-before-3-32-2-contains-a-null-pointer-dereference)
- [FreeRDP memory exhaustion in RD Gateway packet handling](https://junglewise.ai/threats/cve-2026-121399-freerdp-before-3-32-2-contains-a-memory-allocation-vulnerability)