# CVE-2026-121958 - FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable\_GetKeys

DevFeed: [CVE-2026-121958 - FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable\_GetKeys](<https://devfeed.tech/articles/cve-2026-121958-freerdp-through-3-32-1-heap-out-of-bounds-write-via-rdpgfx-hashtable-getkeys-117090.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-121958>)

Author: CVEFEED.io; vulncheck.com

Published: 2026-11-04T16:17:48Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [heap overflow](<https://devfeed.tech/topics/heap-overflow.md>), [Memory Safety](<https://devfeed.tech/topics/memory-safety.md>)

Tags: [cve-2026-121958](<https://devfeed.tech/tags/cve-2026-121958.md>), [freerdp](<https://devfeed.tech/tags/freerdp.md>), [heap](<https://devfeed.tech/tags/heap.md>), [out-of-bounds-write](<https://devfeed.tech/tags/out-of-bounds-write.md>), [write](<https://devfeed.tech/tags/write.md>)

## AI overview

FreeRDP through 3.32.1 is described as vulnerable to a heap out-of-bounds write in its RDPGFX client. The delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent; HashTable_GetKeys can then write beyond its allocated key array. The description says a malicious or man-in-the-middle RDP server can trigger this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, then sending ENDFRAME or RESETGRAPHICS. The reported severity is 8.8 (HIGH).

## Source excerpt

CVE ID :CVE-2026-121958 Published : Nov. 4, 2026, 4:17 p.m. | 56 minutes ago Description :FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...