Skip to main content

FreeRDP CVE-2026-67300

| EUVDEUVD-2026-51821 HIGH
Use After Free (CWE-416)
2026-08-01 VulnCheck GHSA-hp6g-g26j-5q54
Use After Free Buffer Overflow Memory Corruption Freerdp
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network attack from a malicious RDP server; no privileges or user interaction required; impact is availability-only (client crash); AsyncUpdate dependency noted but treated as deployment context rather than complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:14 vuln.today
Analysis Generated
Aug 01, 2026 - 13:14 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

AnalysisAI

Heap use-after-free in FreeRDP's asynchronous update message proxy (all versions before 3.29.0) enables a malicious or compromised RDP server to crash the connecting client or induce memory corruption by sending crafted RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER update packets. The vulnerability surfaces only when the AsyncUpdate option is enabled on the client, limiting but not eliminating real-world exposure given the feature's performance benefits and common usage. Vendor-released patch version 3.29.0 is available; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

FreeRDP (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) is an open-source implementation of Microsoft's Remote Desktop Protocol used widely as a client library on Linux, macOS, and Windows. The flaw exists in the async update message proxy that handles RAIL (Remote Applications Integrated Locally) extension messages - specifically WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER. When AsyncUpdate is enabled, this proxy performs a shallow copy of structures returned by the protocol parser. Those structures contain nested heap-allocated pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers) that are parser-owned: the parser frees them as soon as its callback returns. The async dispatch queue, now holding the shallow-copied structure, later dereferences those freed pointers when processing the queued message. This is a textbook CWE-416 (Use After Free) pattern: the lifecycle of the nested allocations is not extended to match the lifetime of the queued async message, producing dangling pointers that yield memory corruption or a client crash when dereferenced.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later per the vendor security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697, with the upstream fix committed at https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f. Where immediate upgrade is not feasible, disable the AsyncUpdate option in FreeRDP client configuration - this removes the code path through the vulnerable async message proxy entirely and eliminates the vulnerability, though it trades asynchronous update batching for synchronous processing, which may increase perceptible latency on high-latency or high-bandwidth RDP sessions. Organizations connecting to untrusted or shared RDP servers should treat disabling AsyncUpdate as a mandatory interim control until patching is complete.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-67300 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy