CVE-2026-67300: FreeRDP before 3.29.0 Use-After-Free via async message proxy
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0 - Configuration
Disable AsyncUpdate so the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER is not used, preventing stale pointers from later dispatching after the parser callback frees nested buffers.
FreeRDP async update message proxy AsyncUpdate = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67300?
CVE-2026-67300 has a high severity rating of 7.5.
How do I fix CVE-2026-67300?
To fix CVE-2026-67300, upgrade FreeRDP to version 3.29.0 or later.
What type of vulnerability is CVE-2026-67300?
CVE-2026-67300 is a use-after-free vulnerability affecting FreeRDP.
What systems are affected by CVE-2026-67300?
CVE-2026-67300 affects FreeRDP versions prior to 3.29.0.
How can an attacker exploit CVE-2026-67300?
An attacker can exploit CVE-2026-67300 by sending crafted update orders from a malicious RDP server.