CVE-2026-67300 Details
Description
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
A heap use-after-free vulnerability has been identified in FreeRDP versions prior to 3.29.0. This vulnerability occurs on the client side within the asynchronous update message proxy for RAIL 'WINDOW_STATE_ORDER' and 'NOTIFY_ICON_STATE_ORDER', when 'AsyncUpdate' is enabled. The issue arises because the message proxy shallow-copies structures that contain nested parser-owned pointers. After the callback returns, the parser frees these nested buffers, leading to the asynchronous message dispatching stale pointers. This flaw can cause memory corruption or a crash of the FreeRDP client.
Users can upgrade to FreeRDP version 3.29.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |