FreeRDP CVE-2026-67299

AsyncUpdate must be explicitly enabled on the FreeRDP client via the /async-update command-line flag or equivalent API configuration - this is not the default behavior. The victim must connect to an attacker-controlled or compromised RDP server. The server must transmit a specially crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON set. Limiting factors: the vulnerability is entirely client-side and cannot be triggered without the victim initiating a connection to the malicious server; all default FreeRDP deployments lacking /async-update are unaffected regardless of server behavior; no authentication or privileges are required of the attacker beyond operating an accessible RDP server endpoint.

The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects a network-reachable, unauthenticated availability impact, but the AT:N metric appears inconsistent with the exploitation condition: AsyncUpdate must be explicitly enabled via /async-update, which is not the default FreeRDP configuration. This gating condition materially reduces the exploitable population below what AT:N implies. No EPSS data was supplied; no CISA KEV listing exists; no public proof-of-concept has been identified, making this a theoretical-but-credible threat rather than an actively exploited one. The impact is limited to client crash and heap memory corruption with no confidentiality or integrity consequence, which constrains attacker value to denial-of-service. In environments running headless or automated RDP sessions with AsyncUpdate enabled (e.g., Guacamole backends, thin-client farms), repeated crashes could cause meaningful service disruption. Overall real-world priority is moderate: high urgency only in AsyncUpdate-enabled deployments; low urgency elsewhere.

An attacker operates or compromises an RDP server endpoint and social-engineers a user running xfreerdp with the /async-update flag to connect to it. Once the session is established, the server sends a crafted RAIL Window Alternate Secondary Order carrying a WINDOW_ORDER_ICON payload, triggering the shallow copy bug in the async update proxy. The freed iconInfo pointer is subsequently dispatched by the async update thread, corrupting heap memory and crashing the FreeRDP client process; no public proof-of-concept has been identified at time of analysis.