CVE-2026-67299 Overview
CVE-2026-67299 is a client-side heap use-after-free vulnerability in FreeRDP versions before 3.29.0. The flaw resides in the asynchronous update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled, such as when a user runs xfreerdp /async-update. A malicious or compromised Remote Desktop Protocol (RDP) server can send a crafted Remote Application Integrated Locally (RAIL) Window Alternate Secondary Order with WINDOW_ORDER_ICON to trigger memory corruption in the connecting client. The vulnerability is tracked under CWE-416: Use After Free.
Critical Impact
A remote RDP server can corrupt client memory and crash xfreerdp sessions with async updates enabled, disrupting remote desktop availability.
Affected Products
- FreeRDP versions prior to 3.29.0
- xfreerdp client when launched with the /async-update flag
- Applications embedding FreeRDP with AsyncUpdate enabled
Discovery Timeline
- 2026-08-01 - CVE-2026-67299 published to the National Vulnerability Database (NVD)
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67299
Vulnerability Analysis
The vulnerability affects FreeRDP's asynchronous update pipeline for RAIL window icon updates. When AsyncUpdate is enabled, incoming order parsing runs on the parser thread while dispatch runs on the update thread. FreeRDP queues a copy of the order data so the parser can free its own buffers safely.
In update_message_WindowIcon(), FreeRDP performs a shallow CopyMemory() from the parser-owned windowIcon structure into a freshly allocated lParam. The copy duplicates the outer structure but not the nested iconInfo pointer that it owns. Both structures now reference the same underlying heap allocation.
After the parser callback returns, update_recv_window_info_order() invokes cleanup that frees window_icon.iconInfo. The queued asynchronous message still holds the stale pointer and later dereferences it during dispatch, producing the use-after-free condition.
Root Cause
The root cause is a shallow copy of a structure containing owned heap pointers. The message proxy duplicates the container object but transfers ownership of the inner iconInfo buffer implicitly. When the original parser path frees iconInfo, the queued message retains a dangling reference to the same allocation.
Attack Vector
Exploitation requires a client to connect to an attacker-controlled or compromised RDP server with /async-update enabled. The server sends a crafted RAIL Window Alternate Secondary Order carrying the WINDOW_ORDER_ICON bit. No authentication or user interaction is required beyond initiating the RDP session.
// Patch metadata from FreeRDP release-3.28.0
- set(RAW_VERSION_STRING "3.27.2-dev0")
+ set(RAW_VERSION_STRING "3.28.0")
Source: FreeRDP commit 5370fb26. The upstream fix bumps the version and corrects the ownership handling of iconInfo so the async message retains its own copy of the parsed icon data.
Detection Methods for CVE-2026-67299
Indicators of Compromise
- Unexpected xfreerdp process crashes or SIGSEGV signals following an RDP session establishment
- Client-side core dumps that reference update_message_WindowIcon or window_icon.iconInfo frames
- RDP sessions initiated to untrusted or newly observed servers while /async-update is in use
- Repeated short-lived RDP connections from client hosts followed by process termination logs
Detection Strategies
- Inventory endpoints running FreeRDP and flag installations with a version lower than 3.29.0
- Alert on xfreerdp invocations that include the /async-update command-line argument
- Enable Address Sanitizer (ASan) in test or canary environments to surface the use-after-free during triage
- Monitor outbound RDP (TCP 3389) connections from workstations to non-corporate destinations
Monitoring Recommendations
- Collect process crash telemetry from Linux and Windows endpoints running the FreeRDP client
- Baseline expected RDP destinations and alert on connections to previously unseen external hosts
- Ingest FreeRDP client logs into a central data lake for correlation with process termination events
- Track command-line arguments passed to xfreerdp to identify hosts with async updates enabled
How to Mitigate CVE-2026-67299
Immediate Actions Required
- Upgrade FreeRDP to version 3.29.0 or later on all endpoints and container images
- Restrict outbound RDP connections from client workstations to a vetted list of trusted servers
- Disable the /async-update flag on affected clients until patching is complete
- Rebuild and redistribute any downstream applications that statically link FreeRDP
Patch Information
The fix is available in FreeRDP 3.29.0 and later. Distribution maintainers should backport the change referenced in FreeRDP commit 5370fb26. Additional detail is available in the FreeRDP Security Advisory GHSA-34hq-hwjw-q8v3 and the Vulncheck Advisory.
Workarounds
- Launch xfreerdp without the /async-update argument to bypass the vulnerable code path
- Connect only to trusted RDP servers under organizational control
- Enforce egress firewall rules to block RDP traffic to unknown destinations
- Isolate high-risk users behind an RDP gateway that validates server identity
# Verify installed FreeRDP version and remove the vulnerable flag
xfreerdp --version
# Recommended invocation without async-update until patched
xfreerdp /v:trusted-server.internal /u:analyst
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
