Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:18 FreeRDP: FreeRDP: Use-After-Free vulnerability leading to denial of service 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-825

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

A flaw was found in FreeRDP. This client-side heap use-after-free vulnerability occurs when a malicious or compromised Remote Desktop Protocol (RDP) server sends specially crafted update orders. The async update message proxy incorrectly handles memory by shallow-copying structures with pointers that are later freed by the parser. This leads to the use of stale pointers, which can cause memory corruption or a client crash, resulting in a denial of service.

This issue is classified as Moderate severity because exploitation requires a user to connect to a malicious or compromised RDP server, where crafted update orders can trigger a client-side heap use-after-free resulting in an application crash or memory corruption. To mitigate this issue, avoid connecting to untrusted RDP servers. Additionally, if possible, disable the `AsyncUpdate` feature in FreeRDP clients to prevent the vulnerable code path from being exercised. Consult FreeRDP documentation for specific configuration options to disable `AsyncUpdate`. Red Hat Enterprise Linux 10 Fix deferred freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Fix deferred freerdp Red Hat Enterprise Linux 9 Fix deferred freerdp https://www.cve.org/CVERecord?id=CVE-2026-67300 https://nvd.nist.gov/vuln/detail/CVE-2026-67300 https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697 https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-async-message-proxy