CVE-2026-121952

FreeRDP versions before 3.32.2 are vulnerable to an out-of-bounds write within the proxy component. The root cause is that the function rdp_read_bitmap_cache_v2_capability_set only rejects numCellCaches values greater than 5, but the application subsequently accesses the bitmap cache v2 cell arra...