CVE-2026-67301: Freerdp

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Affected products

• Freerdp Freerdp: before 3.29.0 (fixed in 3.29.0)

Published 2026-08-01. Last modified 2026-09-08.