CVE-2026-125394: FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt(), updategdipolygoncb() and updategdimem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.33.0
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients running versions before 3.33.0 are exposed when they connect to a malicious RDP server. The flaw is triggered while processing RDP brush-cache and drawing updates received from that server.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that a FreeRDP client connects to. They can resend a CACHE_BRUSH message to the same cache slot and then send a PATBLT update, without requiring privileges on the client.
What is the likely impact of successful exploitation?
The client may read freed heap memory, which can disclose data, or it may crash. The provided information does not describe integrity impact or code execution.
What remediation is identified?
Update FreeRDP to version 3.33.0 or later. Versions before 3.33.0 are identified as affected.