DEBIAN-CVE-2026-125394: Use After Free
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt(), updategdipolygoncb() and updategdimem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.33.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of FreeRDP clients before 3.33.0 are exposed when they connect to a malicious RDP server. The affected Debian package names listed are freerdp3 and freerdp2.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that the victim connects to. The server can resend CACHE_BRUSH for the same cache slot and then send a PATBLT request, triggering use of a freed brush-cache pointer.
What is the potential impact on an affected client?
The flaw can cause the client to read freed heap memory, which may disclose data or crash the client. The provided severity vector indicates no attacker privileges are required, but user interaction is required.