Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck
CVE-2026-67300FreeRDP before 3.29.0 Use-After-Free via async message proxy
High 7.5
In plain English
A high-severity use-after-free in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-67300 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-67300 |
| Debian:14 | freerdp3 | 3.29.0+dfsg-1 | DEBIAN-CVE-2026-67300 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-67300 |
| Ubuntu:24.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-67300 |
| Ubuntu:26.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-67300 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-33gg-h66j-3697) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: FreeRDP before 3.29.0 Use-After-Free via async message proxy third-party-advisory