How to Fix CVE-2026-121953 in Freerdp

The two-minute check

1. Ask your IT provider or staff whether any computer, phone or server in your business runs Freerdp.
2. Check if Freerdp is used to connect to remote desktops, jump boxes, or a remote access gateway.
3. If you run a remote desktop proxy or gateway service, ask whether it is built on Freerdp.
4. If nobody can answer, ask your provider to check installed software across your devices and servers.

When you can stop reading

If no device, server or gateway in your business runs Freerdp, this record does not apply to you. The affected product listed in the official record is Freerdp itself, nothing else. You do not need to check other remote access tools or unrelated software.

What the official record says

CVE-2026-121953 carries a Common Vulnerability Scoring System (CVSS) score of 9.8, rated CRITICAL (NVD). The scoring details say an attacker can reach this flaw over a network, does not need any special access level, and does not need the victim to click anything. In plain terms: a malicious Freerdp server can trigger a bug in the client where it reuses a piece of memory it had already freed, then feeds that memory with attacker-controlled data. That can crash the client or, in the worst case, let the attacker run their own code on it.

The Exploit Prediction Scoring System (EPSS) estimates a 0.56% chance of exploitation in the next 30 days, placing it at the 47th percentile among scored flaws (FIRST.org). EPSS is a forecast of exploitation activity, not a measure of how severe the flaw itself is.

This record is not on the Known Exploited Vulnerabilities (KEV) catalog maintained by the Cybersecurity and Infrastructure Security Agency. The record shows no confirmed exploitation in the wild yet. That can change, which is exactly why a scheduled patch now is worth doing.

The same vendor update also fixes CVE-2026-121952, CVE-2026-121962, CVE-2026-121964, CVE-2026-121960, CVE-2026-121958, CVE-2026-121956, CVE-2026-121951 and CVE-2026-121957. Several of these affect the client, the server side, or a proxy component, depending on how your deployment uses Freerdp.

What that means for a business like yours

A 9.8 score with no login requirement and no click needed means the bar for an attacker to try this is low. The practical risk depends on exposure: a Freerdp client that connects outbound to servers you trust is a different risk than a Freerdp-based gateway sitting open to the internet. Either way, this is the kind of flaw worth fixing on a normal patch cycle, not something to panic over.

If someone else manages your IT

Send this to your IT provider or internal team:

• "Please check whether we run Freerdp anywhere, including any remote desktop gateway."
• "If we do, please apply the vendor update covering CVE-2026-121953 and the related fixes."
• "Please confirm the update is installed and tell me the date it was applied."

If you already work with a managed IT provider, this kind of patch should be part of their regular managed IT services work. If you want a second opinion on your patch coverage, a free IT assessment is a good place to start.

If you manage it yourself

1. Find every computer, phone, or server that has Freerdp installed, including any remote desktop gateway software built on it.
2. Open the vendor security advisory for this flaw (GitHub advisory).
3. Follow the advisory's instructions to update past the versions it lists as affected.
4. Restart any Freerdp client or server process after the update finishes.
5. Repeat on every machine you identified in step one.
6. Write down the date you patched each device, in case you need to show it later.

There is no confirmed exploitation in the record right now, so there is no need to treat this as an emergency outage. A sensible window is to patch within your next regular maintenance cycle, ideally within a couple of weeks. If this flaw appears on the KEV catalog later, or if active exploitation gets reported, that changes the picture and moves patching to the top of the list.

Do not just trust an installer's progress bar. After patching, open Freerdp's version or about information and compare it against the version noted in the vendor advisory as fixed. If you manage multiple machines, ask your provider for a list showing the Freerdp version on each one. If any device still shows an older version after the patch window, treat it as unpatched and start again.

If you cannot patch immediately, limit which servers your Freerdp clients are allowed to connect to, since the flaw is triggered by a malicious server. Restrict any Freerdp-based gateway so it is reachable only from trusted networks, not the open internet. Neither step removes the flaw; both reduce how easily it can be reached while you schedule the real fix. Tightening who can reach administrative tools is also a good moment to review your privileged access controls more broadly.

Do I have to do anything if we only use this at home?

This guide is written for business use, but the same check applies anywhere Freerdp is installed. If a home computer runs it, the same patch applies there too.

Will patching break anything?

The record does not say which builds are affected beyond the version numbers in the vendor advisory. Standard practice is to test the update on one machine first, then roll it out to the rest once you confirm normal remote desktop connections still work.

Does this mean we've already been attacked?

No. The record shows no confirmed exploitation of this flaw. Patching now is routine maintenance, not a response to a known incident.

We use a managed remote access gateway. Are we covered?

Ask the vendor or provider of that gateway whether it is built on Freerdp, and if so, whether they have already applied this update. If you are unsure how your vendors handle this, our cybersecurity services team can help you ask the right questions.

Does this affect our compliance obligations?

If your business handles regulated data, unpatched critical flaws can matter for audits under frameworks like the FTC Safeguards Rule. Patching promptly and documenting the date helps keep that record clean.

LayerLogix brings 20+ years of experience and 100% U.S.-based support to patch management and remote access security. If you want help confirming your exposure to CVE-2026-121953 or getting a patch cycle in place, contact us or start with a free IT assessment.