CVE-2026-67299: FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In updatemessageWindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, updaterecvwindowinfoorder() frees windowicon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOWORDERICON can trigger use-after-free, leading to memory corruption and client crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0Patch FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67299?
The severity of CVE-2026-67299 is high with a score of 7.5.
How do I fix CVE-2026-67299?
To fix CVE-2026-67299, update to FreeRDP version 3.29.0 or later.
What type of vulnerability is CVE-2026-67299?
CVE-2026-67299 is classified as a Use After Free vulnerability.
Where does CVE-2026-67299 occur in FreeRDP?
CVE-2026-67299 occurs in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled.
What impact does CVE-2026-67299 have on users?
CVE-2026-67299 can lead to a denial of service due to a client-side heap use-after-free.