6 matches found
EUVD-2026-116961
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...
CVE-2026-121961
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...
CVE-2026-121961 FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...
CVE-2026-121961
FreeRDP versions before 3.32.2 are vulnerable to a use-after-free condition in the freerdp-proxy DRDYNVC tracker during drdynvc channel interception. The root cause is a race condition where a malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel ID, racing the fron...
PT-2026-137013
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE REQUEST PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...
CVE-2026-121961: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting…
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...