CVE-2026-67300

FreeRDP before 3.29.0 Use-After-Free via async message proxy

Published Aug 1, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

Analysis

Technical impact

The vulnerability is a client‑side use‑after‑free in the FreeRDP async message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. A malicious or compromised RDP server can send crafted update orders that shallow‑copy structures containing nested pointers. When the parser frees those nested buffers after the callback returns, the queued async message dispatches stale pointers, potentially corrupting memory or crashing the client. This issue is classified as CWE-416 and CWE-825.

Affected Systems

FreeRDP before version 3.29.0 is affected. The flaw exists in client versions earlier than 3.29.0 of the FreeRDP project.

Risk and Exploitability

The CVSS score of 8.7 classifies this as high severity. The EPSS score of 0.00329 indicates an extremely low but non‑zero probability of exploitation, and it is not listed in the CISA KEV catalog. The flaw can still be triggered remotely from a malicious RDP server when AsyncUpdate is enabled. The exploitation would lead to memory corruption or a client crash, compromising availability and potentially allowing further attacks if the corruption is leveraged. The risk is elevated for systems exposed to untrusted RDP servers. The vulnerability is classified as CWE-416 and CWE-825.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

unaffected

Version	Status	Constraints
`0`	affected	< 3.29.0
`3.29.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[0,3.29.0)`	affected	semver	—
`3.29.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update FreeRDP to 3.29.0 or later to apply the official fix
If upgrading is not immediately possible, disable the AsyncUpdate feature to mitigate the use‑after‑free path
Monitor the client for abnormal crashes or memory errors after changes and apply patches as soon as available

Generated by OpenCVE AI on August 4, 2026 at 22:10 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.344% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697
https://nvd.nist.gov/vuln/detail/CVE-2026-67300
https://www.cve.org/CVERecord?id=CVE-2026-67300
https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-async-message-proxy

History

Aug 3, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 3, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-67300 https://www.cve.org/CVERecord?id=CVE-2026-67300
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 1, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Title		FreeRDP before 3.29.0 Use-After-Free via async message proxy
First Time appeared		Freerdp Freerdp freerdp
Weaknesses		CWE-416
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Vendors & Products		Freerdp Freerdp freerdp
References		https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-33gg-h66j-3697 https://www.vulncheck.com/advisories/freerdp-before-use-after-free-via-async-message-proxy
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`