Bug 2567521 (CVE-2026-121957)

Summary: CVE-2026-121957 freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a race condition in the client by concurrently transmitting graphics reset commands alongside compressed bitmap data. This flaw leads to a use-after-free condition or out-of-bounds memory access on shared graphics decoding buffers. Consequently, an attacker can corrupt client memory, potentially causing the client application to crash resulting in a Denial of Service (DoS) or exposing sensitive memory contents.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2568302, 2568304    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-05 22:04:32 UTC 
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.