Out-of-Bounds Read Vulnerability in FreeRDP Affects Various Versions

CVE-2026-67301

What is CVE-2026-67301?

FreeRDP, prior to version 3.29.0, contains vulnerabilities allowing for out-of-bounds reads within the async update message proxy for PolygonSC and PolygonCB. When AsyncUpdate is enabled (for example, using xfreerdp /async-update), the functions update_message_PolygonSC() and update_message_PolygonCB() allocate a new points array but mistakenly copy point data from the order structure's address instead of the correct polygon points. This flaw can be exploited by a malicious or compromised RDP server to send specially crafted PolygonSC/PolygonCB update orders, leading to potential memory disclosure or crashes on the client side.

References