CVE-2026-121964 FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

Description

FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution.

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

Interaction

None

Confidentiality

None

Integrity

None

Availability

High

Confidentiality of other systems

None

Integrity of other systems

None

Availability of other systems

None

Affected products and versions