FreeRDP up to 3.28.9 Async Update Message Proxy update_message_PolygonSC/update_message_PolygonCB out-of-bounds

Summaryinfo

A vulnerability classified as critical has been found in FreeRDP up to 3.28.9. This impacts the function update_message_PolygonSC/update_message_PolygonCB of the component Async Update Message Proxy. Performing a manipulation results in out-of-bounds. This vulnerability is identified as CVE-2026-67301. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in FreeRDP up to 3.28.9. It has been classified as critical. This affects the function update_message_PolygonSC/update_message_PolygonCB of the component Async Update Message Proxy. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-67301 since 07/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.29.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.28.0
• 3.28.1
• 3.28.2
• 3.28.3
• 3.28.4
• 3.28.5
• 3.28.6
• 3.28.7
• 3.28.8
• 3.28.9

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion