Client-Side Heap Vulnerability in FreeRDP Affects Remote Desktop Users

CVE-2026-67299

What is CVE-2026-67299?

FreeRDP before version 3.29.0 features a significant client-side heap use-after-free vulnerability related to the async update message proxy specifically for WINDOW_ICON_ORDER. When AsyncUpdate is active, a flaw in the update_message_WindowIcon function allows a shallow CopyMemory operation to overwrite a freshly allocated lParam->iconInfo with a pointer from the parser's windowIcon->iconInfo. Post parser callback execution, the update_recv_window_info_order function erroneously frees the window_icon.iconInfo, leaving the queued async message with a stale reference that, when dispatched, can lead to memory corruption and result in client crashes, especially if a malicious RDP server sends specially crafted inputs.

References