Client-Side Heap Use-After-Free Vulnerability in FreeRDP

CVE-2026-67300

What is CVE-2026-67300?

FreeRDP prior to version 3.29.0 is susceptible to a client-side heap use-after-free vulnerability. This affects the async update message proxy specifically when handling RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER. When AsyncUpdate is enabled, a malicious or compromised RDP server can exploit this vulnerability by sending crafted update orders that manipulate the message proxy. The proxy performs shallow copies of structures containing nested parser-owned pointers, which results in critical information being freed prematurely. Consequently, when these stale pointers are later accessed during queued async message dispatch, it may lead to memory corruption, potentially causing client crashes and exposing sensitive data.

References