Skip to main content

FreeRDP CVE-2026-67299

| EUVDEUVD-2026-51820 HIGH
Use After Free (CWE-416)
2026-08-01 VulnCheck GHSA-jq8c-588g-4wgj
Use After Free Buffer Overflow Memory Corruption Freerdp
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

AsyncUpdate non-default config raises AC:H; user must actively connect to attacker server (UI:R); impact is crash only with no C or I consequence.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:13 vuln.today
Analysis Generated
Aug 01, 2026 - 13:13 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.

AnalysisAI

Heap use-after-free in FreeRDP's async update message proxy allows a malicious or compromised RDP server to crash the client and corrupt heap memory through a crafted RAIL WINDOW_ORDER_ICON message. The flaw is gated on the AsyncUpdate feature being explicitly enabled via the /async-update flag - a non-default client configuration - which limits real-world exposure relative to the CVSS 4.0 score of 8.7. All FreeRDP versions prior to 3.29.0 (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) are affected; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

FreeRDP implements the Microsoft Remote Desktop Protocol client stack, including RAIL (Remote Applications Integrated Locally) extensions for windowed remote applications. CWE-416 (Use After Free) manifests in the async update message proxy path active when AsyncUpdate mode is enabled. In update_message_WindowIcon(), a shallow CopyMemory() call copies the parser-owned windowIcon->iconInfo pointer directly into lParam->iconInfo of a newly queued async message rather than performing a deep allocation and copy. When the parser callback update_recv_window_info_order() returns, it frees window_icon.iconInfo. The async dispatch queue, however, retains the now-freed pointer. When the queued WINDOW_ICON_ORDER message is later dispatched on the update thread, it dereferences the stale iconInfo pointer, producing a heap use-after-free. The affected CPE (cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) covers all FreeRDP builds and platforms that include this async proxy code path.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later per the security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3. The upstream fix is available in commit 5370fb26fbf034ecd11d3026b6ad639b5fff493f (https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f), though the commit diff reflects a version string of 3.28.0 rather than 3.29.0 - verify the authoritative fix version against the FreeRDP GitHub releases before deploying. As an immediate compensating control requiring no upgrade, remove the /async-update flag from all xfreerdp invocations and equivalent programmatic configurations; this eliminates the vulnerable code path entirely since AsyncUpdate is a performance optimization and not required for core RDP functionality, with no side effects on session correctness.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-67299 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy