FreeRDP CVE-2026-67301

|

EUVD

EUVD-2026-51857 HIGH

Out-of-bounds Read (CWE-125)

2026-08-01 VulnCheck

GHSA-vpv4-cm44-pgmc

Buffer Overflow Information Disclosure Freerdp

8.7

CVSS 4.0 · Vendor: VulnCheck

Share

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network vector as attacker controls the server; UI:R because victim must initiate the RDP connection; C:L for possible heap memory disclosure; A:H for client crash; no scope change or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

X

Lifecycle Timeline

3

Source Code Evidence Fetched

Aug 01, 2026 - 13:14 vuln.today

Analysis Generated

Aug 01, 2026 - 13:14 vuln.today

CVE Published

Aug 01, 2026 - 12:22 cve.org

HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

AnalysisAI

Out-of-bounds read in FreeRDP's async update message proxy exposes clients to memory disclosure or process crash when connecting to a malicious or compromised RDP server with AsyncUpdate enabled. The flaw is in update_message_PolygonSC() and update_message_PolygonCB(), which allocate a fresh points array but copy data from the enclosing order structure's base address rather than from the correct ->points member, reading adjacent heap memory. All FreeRDP versions before 3.29.0 are affected; no CISA KEV listing and no public exploit code exist at time of analysis.

Technical ContextAI

FreeRDP (cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) is an open-source Remote Desktop Protocol client library used in tools such as xfreerdp and Remmina. The vulnerability class is CWE-125 (Out-of-Bounds Read), rooted in a pointer arithmetic error in the asynchronous update message proxy layer - a secondary thread that handles RDP drawing orders when /async-update is active. PolygonSC and PolygonCB are primary drawing orders in the RDP graphics pipeline used to render filled and outline polygons. In the proxy path, the affected functions allocate a new points buffer for proxying these orders but then perform the data copy from &order (the address of the structure itself) instead of from order->polygonSC.points or order->polygonCB.points. This causes a read past the intended array bounds into adjacent heap memory, which may contain sensitive process data or trigger an access violation. The flaw is entirely client-side: a server that controls the drawing order stream can weaponize it against any connected client running the async path.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later per the vendor advisory GHSA-vxp3-7g6q-rq2w (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2w). Important caveat: the patch commit (https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f) shows a CMake version bump to 3.28.0, not 3.29.0 - operators should verify their installed build against the advisory's stated fix boundary of 3.29.0 rather than relying solely on the version string, as additional commits may be required. If immediate upgrade is not feasible, the most effective compensating control is to remove the /async-update flag from all xfreerdp invocations and RDP client wrapper scripts; this eliminates the vulnerable code path entirely since update_message_PolygonSC() and update_message_PolygonCB() are only reachable via the async proxy thread. As an additional layer, restrict FreeRDP clients to connecting only to internally trusted, verified RDP servers to prevent exposure to crafted drawing orders from attacker-controlled endpoints.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2025-5777 CRITICAL POC

CVE-2016-1646 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected

Share

CVE-2026-67301 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy