{"id":"EM-20261104-N9OL","url":"https://cyber.eventmonitor.net/incident/EM-20261104-N9OL/freerdp-vulnerability-cve-2026-121957/","type":"cve","title":"FreeRDP Vulnerability (CVE-2026-121957)","subtitle":"CVE-2026-121957","subject":"CVE-2026-121957","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-04T16:17:48.423Z","firstSignal":"2026-11-04T15:33:21.000Z","lastSignal":"2026-11-04T16:17:48.423Z","updated":"2026-11-07T00:59:45.971Z","revision":1,"life":[{"status":"Born","at":"2026-11-04T16:17:48.423Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-04T16:17:48.423Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T15:33:21.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-04T16:17:48.423Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261104-N9OL created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T16:17:48.423Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T16:17:48.423Z","detail":"CVSS 8.7 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-04T15:33:21.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T15:33:21.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-121957 (important)","text":"freerdp: freerdp: Memory corruption via race condition in planar bitmap decoding","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-121957.json"},{"at":"2026-11-04T16:17:48.423Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-121957 (CVSS 8.7)","text":"FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121957"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T16:17:48.423","score":8.7,"severity":"HIGH","desc":"FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to…","product":"Freerdp","seen":1793917591435},"kev":null,"epss":{"epss":0.00244,"pct":0.15701,"at":1794013185971},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}