CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free (CWE-416) in the async update message proxy for WINDOW_ICON_ORDER, which is active only when AsyncUpdate is enabled, for example by launching xfreerdp with the /async-update flag. A malicious or compromised RDP server can send a crafted RAIL Window Alternate Secondary Order containing WINDOW_ORDER_ICON, causing update_message_WindowIcon() to overwrite a freshly allocated structure with a parser-owned pointer that is freed by update_recv_window_info_order() before the queued async message later dispatches the stale pointer. An attacker who controls or can impersonate an RDP server that a vulnerable client connects to gains memory corruption that crashes the client (availability impact is rated high; confidentiality and integrity are not affected per the CVSS vector). Anyone running a FreeRDP-based client with AsyncUpdate enabled when connecting to untrusted RDP servers is affected. No in-the-wild exploitation is reported yet, but a public proof-of-concept reference exists in the FreeRDP security advisory (GHSA-34hq-hwjw-q8v3) and exploitation probability is modest (EPSS ~0.3% over 30 days).

What to do: Upgrade FreeRDP to 3.29.0 or later as the definitive fix. Where upgrading is not immediately possible, stop launching clients with /async-update (or disable AsyncUpdate in library integrations) and only connect to trusted RDP servers. Audit startup scripts, wrappers, and embedded product configurations for the /async-update flag to determine whether deployments exercise the affected code path.