CVE-2026-67301: FreeRDP Information Disclosure Vulnerability

CVE-2026-67301 Overview

CVE-2026-67301 is an out-of-bounds read vulnerability in FreeRDP versions prior to 3.29.0. The flaw affects the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled, such as through xfreerdp /async-update, the functions update_message_PolygonSC() and update_message_PolygonCB() copy point data from the address of the order structure rather than from polygonSC->points or polygonCB->points. A malicious or compromised RDP server can send crafted polygon update orders to trigger client-side memory disclosure or a crash.

Critical Impact
A compromised or hostile RDP server can force connecting FreeRDP clients to read out-of-bounds memory, leaking process memory contents or crashing the client session.

Affected Products

FreeRDP versions prior to 3.29.0
xfreerdp client when invoked with /async-update
Applications and distributions embedding vulnerable FreeRDP libraries

Discovery Timeline

2026-08-01 - CVE-2026-67301 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67301

Vulnerability Analysis

The vulnerability resides in FreeRDP's asynchronous update message proxy, which marshals drawing orders between threads when AsyncUpdate is enabled. For the PolygonSC (Polygon Solid Color) and PolygonCB (Polygon Color Brush) primary drawing orders, the proxy allocates a fresh points array to safely duplicate variable-length point data. The copy operation uses the wrong source pointer, reading from the address of the order structure itself instead of the dedicated points buffer. This produces a client-side out-of-bounds read classified as [CWE-125].

The issue is triggered exclusively from the server side of the RDP session. A hostile server, or an attacker who has hijacked a legitimate server, can craft PolygonSC or PolygonCB update messages that force the client to read adjacent memory. The impact is limited to availability and confidentiality of client memory, with no direct code execution vector documented in the advisory.

Root Cause

The root cause is an incorrect source operand in the memcpy-style copy inside update_message_PolygonSC() and update_message_PolygonCB(). The functions copy numPoints * sizeof(DELTA_POINT) bytes from &polygonSC (the order structure address) instead of polygonSC->points. The allocated destination buffer is correct, but the source pointer references stack or heap memory unrelated to the actual point array.

Attack Vector

Exploitation requires the FreeRDP client to connect to an attacker-controlled RDP server with /async-update enabled. No user interaction or authentication is required beyond establishing the RDP session. The server sends a crafted primary drawing order containing a PolygonSC or PolygonCB message, which the client dispatches through the async proxy and triggers the out-of-bounds read.

text

// Patch reference: cmake/GetProjectVersion.cmake
-  set(RAW_VERSION_STRING "3.27.2-dev0")
+  set(RAW_VERSION_STRING "3.28.0")
// Source: https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f

The fix corrects the source pointer to reference polygonSC->points and polygonCB->points respectively. See the FreeRDP security advisory GHSA-vxp3-7g6q-rq2w for the full patch context.

Detection Methods for CVE-2026-67301

Indicators of Compromise

Unexpected xfreerdp or FreeRDP-based client crashes shortly after connecting to a remote RDP server
Outbound RDP (TCP/3389) connections from workstations to untrusted or newly registered domains and hosts
FreeRDP client invocations that include the /async-update flag against non-corporate destinations

Detection Strategies

Inventory installed FreeRDP versions across Linux, macOS, and Windows endpoints and flag any build below 3.29.0
Correlate process crash telemetry for xfreerdp and applications linking libfreerdp with preceding outbound RDP session establishment
Inspect command-line arguments and configuration files for the /async-update option in RDP client launch events

Monitoring Recommendations

Log all outbound RDP connections and alert on sessions to destinations outside approved server inventories
Monitor package manager events for updates to freerdp, freerdp2, and freerdp3 packages across managed hosts
Track segmentation faults and abnormal exits from FreeRDP-based clients such as Remmina, GNOME Connections, and Weston

How to Mitigate CVE-2026-67301

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all affected systems and rebuild any downstream applications that statically link the library
Restrict outbound RDP connections from workstations to a defined allowlist of trusted internal RDP servers
Disable AsyncUpdate by removing the /async-update flag from FreeRDP client invocations until patching is complete

Patch Information

The vulnerability is fixed in FreeRDP 3.29.0. The upstream fix is available in commit 5370fb26fbf034ecd11d3026b6ad639b5fff493f. Refer to the VulnCheck advisory and the GitHub Security Advisory GHSA-vxp3-7g6q-rq2w for backport guidance from distribution maintainers.

Workarounds

Run FreeRDP clients without the /async-update option, which disables the vulnerable async proxy path
Only connect to RDP servers under organizational control and avoid untrusted or third-party hosts
Enforce network egress filtering to block RDP traffic to arbitrary internet destinations

bash

# Verify installed FreeRDP client version
xfreerdp --version

# Launch FreeRDP without the vulnerable async update path
xfreerdp /v:rdp.internal.example.com /u:analyst

# Debian/Ubuntu: update FreeRDP packages
sudo apt update && sudo apt install --only-upgrade freerdp3-x11 libfreerdp3

# Fedora/RHEL: update FreeRDP packages
sudo dnf upgrade freerdp