CVE-2026-121952 freerdp freerdp: Out-of-bounds Write

This vulnerability is rated Important rather than Critical. A remote client can trigger memory corruption in freerdp-proxy without additional user interaction on the proxy host, but freerdp-proxy is not enabled or exposed by default and must be deliberately deployed. Turning the constrained out-of-bounds write into reliable arbitrary code execution depends on heap layout and a fully established proxy path to a backend server. Confirmed impacts include proxy process crash and potential heap content leakage to the backend. This Important rating aligns with the upstream High severity advisory rather than a Critical network-service compromise on a default Red Hat deployment.

If freerdp-proxy is not required, do not run it. Where proxy use is necessary, restrict listening access to trusted client networks and require client authentication.

--- CME Mitigation Guidance (2026-11-06) ---

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce minimum bounds validation on client-declared numCellCaches before allocating the bitmap cache array in freerdp-proxy: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which reject Bitmap Cache v2 capability sets declaring numCellCaches values below five, closing all 2 injection vectors (Crafted Confirm Active PDU declaring numCellCaches below five, Bitmap Cache v2 capability with persistent keys enabled). Until patched, this is a concern on Deployments running the freerdp-proxy component accessible to network clients, so Disable freerdp-proxy if not required, or restrict network access to trusted client networks and enforce client authentication. As a compensating measure, Enable Address Space Layout Randomization to randomize proxy memory layout and hinder reliable heap exploitation, Enforce full RELRO and PIE on the freerdp-proxy binary to prevent Global Offset Table overwrites, and Enable Control Flow Integrity to restrict indirect branch targets to valid functions if heap metadata is corrupted. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds heap write defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)