CVE-2026-67300
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
77/100
Published: 2026-08-01
Modified: 2026-11-03
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
None
VI:
None
VA:
High
Description
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Weakness Classification (1)
References & Advisories (3)
Patch
Third Party Advisory
Patch
Exploit
Vendor Advisory