CVE-2026-67299 Details
Description
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
A heap use-after-free vulnerability has been identified in FreeRDP versions prior to 3.29.0. This issue occurs in the client-side asynchronous update message proxy for WINDOW_ICON_ORDER when the AsyncUpdate feature is enabled. A malicious or compromised RDP server can exploit this vulnerability by sending a crafted RAIL Window Alternate Secondary Order that includes WINDOW_ORDER_ICON. The vulnerability arises because a shallow memory copy operation overwrites a newly allocated icon information pointer with a reference owned by the parser. After the parser callback completes, the original pointer is freed, but the asynchronous message dispatches a stale pointer, leading to memory corruption and a crash of the FreeRDP client.
Users can upgrade to FreeRDP version 3.29.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f | [email protected] | Patch |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-34hq-hwjw-q8v3 | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-windowicon-async-message | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.29.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |