CVE-2026-67300 in FreeRDP
Summary
by MITRE • 08/01/2026
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability described represents a critical heap use-after-free condition affecting FreeRDP versions prior to 3.29.0, specifically within the asynchronous update message proxy implementation. This flaw exists in the handling of RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER messages when the AsyncUpdate feature is enabled. The root cause stems from improper memory management practices during the processing of remote desktop protocol update orders, creating opportunities for remote code execution or denial of service attacks.
The technical implementation flaw occurs in the message proxy component where structures containing nested parser-owned pointers are shallow-copied rather than deep-copied. Key data elements such as titleInfo.string, windowRects, visibilityRects, and icon buffers are transferred without proper memory ownership transfer mechanisms. When the RDP parser processes these messages and subsequently frees the nested buffer memory after the callback execution completes, the queued asynchronous message dispatch operations reference stale memory addresses. This creates a classic use-after-free scenario where freed memory locations are accessed by subsequent operations, leading to potential memory corruption or application crashes.
From an operational perspective, this vulnerability presents significant security risks as it can be exploited through malicious or compromised RDP servers that send crafted update orders. The attack vector requires the victim to have AsyncUpdate enabled in their FreeRDP client configuration, making it particularly concerning for organizations that rely on remote desktop protocols for administrative access. The impact extends beyond simple crashes to potentially enable arbitrary code execution, as memory corruption can be leveraged to manipulate program execution flow or escalate privileges depending on the target system configuration.
The vulnerability aligns with CWE-416, which specifically addresses use-after-free conditions in software implementations, and demonstrates characteristics consistent with ATT&CK technique T1210 - Exploitation of Remote Services. Organizations utilizing FreeRDP for remote desktop connections should immediately implement mitigations including patching to version 3.29.0 or later, disabling AsyncUpdate functionality where possible, and implementing network segmentation controls to limit exposure to potentially compromised RDP servers. Additionally, monitoring for unusual RDP traffic patterns and implementing intrusion detection systems can help identify potential exploitation attempts targeting this specific vulnerability.