CVE-2026-67301

Description

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Weakness classification

• disclosure@vulncheck.com: CWE-125

Primary references

• disclosure@vulncheck.com — Patch
• disclosure@vulncheck.com — Exploit, Vendor Advisory
• disclosure@vulncheck.com — Patch, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory