FreeRDP CVE-2026-67300

Exploitation requires two specific conditions to be simultaneously present: (1) the FreeRDP client must have the AsyncUpdate option enabled - this activates the asynchronous message proxy code path that performs the unsafe shallow copy, and without it the vulnerable branch is never reached; and (2) the attacker must occupy the RDP server role, either by operating a malicious server or by compromising a legitimate one to which the target client connects. Limiting factors include: the vulnerability is entirely client-side and cannot be triggered by a passive network attacker; the attacker must be in an active server position, not a man-in-the-middle without server control; and the AsyncUpdate configuration must be explicitly active on the client. Unauthenticated clients who connect to attacker-controlled servers with AsyncUpdate disabled are not affected.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects a high-severity, network-reachable availability impact with no privileges required. However, the AT:N (no attack requirements) rating warrants scrutiny: the description explicitly conditions exploitation on AsyncUpdate being enabled, which is a deployment-specific option rather than a universal default. If AsyncUpdate is non-default, AT:P would more accurately represent real-world exploitability, and the effective score would decrease. No EPSS data was provided, limiting probability-based triage. No CISA KEV entry exists, and no proof-of-concept has been identified, reinforcing that this is not currently under widespread active exploitation. The memory corruption primitive theoretically extends beyond denial-of-service to arbitrary code execution on the client, but the official CVSS assessment caps impact at VA:H with no confidentiality or integrity impact - a conservative but defensible position absent confirmed exploitation. The primary real-world risk is environments connecting FreeRDP clients to untrusted or shared RDP infrastructure with AsyncUpdate enabled.

An attacker who controls or has compromised an RDP server waits for a FreeRDP client with AsyncUpdate enabled to establish a session. The attacker's server sends a sequence of crafted RAIL WINDOW_STATE_ORDER or NOTIFY_ICON_STATE_ORDER update messages; the client's async proxy shallow-copies the parsed structures, the parser frees the nested heap buffers (titleInfo.string, windowRects, icon data), and when the async dispatcher later processes the queued message it dereferences the now-freed pointers, crashing the client process or triggering exploitable memory corruption. No public proof-of-concept exploit code has been identified at time of analysis.