Description
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Published: 2026-08-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a client‑side use‑after‑free in the FreeRDP async message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. A malicious or compromised RDP server can send crafted update orders that shallow‑copy structures containing nested pointers. When the parser frees those nested buffers after the callback returns, the queued async message dispatches stale pointers, potentially corrupting memory or crashing the client. This issue is classified as CWE-416 and CWE-825.

Affected Systems

FreeRDP before version 3.29.0 is affected. The flaw exists in client versions earlier than 3.29.0 of the FreeRDP project.

Risk and Exploitability

The CVSS score of 8.7 classifies this as high severity. The EPSS score of 0.00329 indicates an extremely low but non‑zero probability of exploitation, and it is not listed in the CISA KEV catalog. The flaw can still be triggered remotely from a malicious RDP server when AsyncUpdate is enabled. The exploitation would lead to memory corruption or a client crash, compromising availability and potentially allowing further attacks if the corruption is leveraged. The risk is elevated for systems exposed to untrusted RDP servers. The vulnerability is classified as CWE-416 and CWE-825.

Generated by OpenCVE AI on August 4, 2026 at 22:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update FreeRDP to 3.29.0 or later to apply the official fix
  • If upgrading is not immediately possible, disable the AsyncUpdate feature to mitigate the use‑after‑free path
  • Monitor the client for abnormal crashes or memory errors after changes and apply patches as soon as available

Generated by OpenCVE AI on August 4, 2026 at 22:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 01 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Title FreeRDP before 3.29.0 Use-After-Free via async message proxy
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-416
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-03T15:37:40.158Z

Reserved: 2026-07-29T13:04:41.947Z

Link: CVE-2026-67300

cve-icon Vulnrichment

Updated: 2026-08-03T15:00:26.333Z

cve-icon NVD

Status : Received

Published: 2026-08-01T13:16:59.393

Modified: 2026-08-03T17:16:40.480

Link: CVE-2026-67300

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-01T12:22:18Z

Links: CVE-2026-67300 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T22:15:03Z

Weaknesses