Vulnerability Description
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff49
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697
- https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-async-mes
FAQ
What is CVE-2026-67300?
CVE-2026-67300 is a vulnerability with a CVSS score of 7.5 (HIGH). FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. Wh...
How severe is CVE-2026-67300?
CVE-2026-67300 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67300?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.