CVE-2026-67301: FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), updatemessagePolygonSC() and updatemessagePolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0 - Configuration
Disable AsyncUpdate (e.g., do not use xfreerdp /async-update) to avoid the out-of-bounds read in update_message_PolygonSC() / update_message_PolygonCB() present in FreeRDP before 3.29.0.
FreeRDP (Polygon async update / async update message-proxy) AsyncUpdate = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67301?
The severity of CVE-2026-67301 is high with a score of 8.7.
What vulnerability is associated with CVE-2026-67301?
CVE-2026-67301 describes out-of-bounds read vulnerabilities in FreeRDP before version 3.29.0.
How do I fix CVE-2026-67301?
To fix CVE-2026-67301, update FreeRDP to version 3.29.0 or later.
What kind of impact does CVE-2026-67301 have on FreeRDP?
CVE-2026-67301 can lead to data loss or crashes due to out-of-bounds reads.
Is AsyncUpdate affected by CVE-2026-67301?
Yes, when AsyncUpdate is enabled, CVE-2026-67301 can be exploited through the async update message proxy.