CVE-2026-67301

FreeRDP before 3.29.0 contains a client-side out-of-bounds read (CWE-125) in the asynchronous update message proxy for the PolygonSC and PolygonCB primary drawing orders: update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure itself instead of from polygonSC->points / polygonCB->points. The flaw is triggered when a FreeRDP client with AsyncUpdate enabled (for example via xfreerdp /async-update) connects to a malicious or compromised RDP server that sends crafted PolygonSC or PolygonCB update orders. A successful attack can cause the client to read beyond the allocated buffer, resulting in potential memory disclosure or a client crash; the CVSS 4.0 score of 8.7 (High) reflects high availability impact. Users of FreeRDP-based RDP clients running affected versions with async update enabled are affected, most typically xfreerdp users and products that embed the FreeRDP library. There is no evidence of exploitation in the wild (not in CISA KEV, EPSS 0.4%), but a public advisory with proof-of-concept details is available (GHSA-vxp3-7g6q-rq2w).

What to do: Upgrade FreeRDP to 3.29.0 or later. Until patched, avoid enabling /async-update (disable AsyncUpdate) when connecting to untrusted or potentially compromised RDP servers, since this is the trigger condition. Operators of thin-client fleets and products embedding the FreeRDP library should refresh the bundled FreeRDP version; no in-the-wild exploitation is reported (EPSS 0.4%, not in CISA KEV), so patching at normal cadence is reasonable for configurations that do not use async update.