What is GHSA-fj72-5ch7-35jh?

GHSA-fj72-5ch7-35jh is a security advisory published by GitHub Security Advisories with Critical severity. FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a...

Which CVE IDs does GHSA-fj72-5ch7-35jh cover?

GHSA-fj72-5ch7-35jh covers the following CVE IDs: CVE-2026-121953. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fj72-5ch7-35jh?

GHSA-fj72-5ch7-35jh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-fj72-5ch7-35jhCriticalCVSS 9.8

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a...

Vendor

GitHub Security Advisories

Published

November 4, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-121953 →

📋 Description

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

🔗 References (4)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp
https://nvd.nist.gov/vuln/detail/CVE-2026-121953
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-dynamic-virtual-channel-close
https://github.com/advisories/GHSA-fj72-5ch7-35jh