UBUNTU-CVE-2026-125394: Use After Free

Published Nov 10, 2026

Updated

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt(), updategdipolygoncb() and updategdimem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.

Affected Software

2 affected components

ubuntu/freerdp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.33.0

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed?

Ubuntu systems using FreeRDP versions before 3.33.0 are affected when acting as an RDP client and connecting to a malicious RDP server.

What does an attacker need to exploit this issue?

An attacker needs to operate or control a malicious RDP server and have a FreeRDP client connect to it. Exploitation involves resending CACHE_BRUSH to a cache slot and then sending PATBLT-related updates.

How can I determine whether a system is affected?

Check the installed FreeRDP version. Versions before 3.33.0 are affected; the provided data does not identify a configuration-based workaround or mitigation.

UBUNTU-CVE-2026-125394: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

How can I determine whether a system is affected?