Heap Use-After-Free Vulnerability in FreeRDP by FreeRDP

CVE-2026-125394

What is CVE-2026-125394?

The FreeRDP software prior to version 3.33.0 contains a heap use-after-free vulnerability in the functions responsible for graphical updates, specifically update_gdi_patblt(), update_gdi_polygon_cb(), and update_gdi_mem3blt(). This flaw arises due to stale brush cache pointers that can be manipulated by a malicious RDP server. By forcing the server to resend a CACHE_BRUSH to the same slot followed by a PATBLT operation, an attacker may lead clients to access freed heap memory. This action can result in unintended data disclosure or cause system crashes, compromising the integrity and availability of the system.

References