FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade libwinpr-devel | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | No solution existsUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-debuginfo | Aug 5, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade libwinpr-debuginfoUpgrade freerdp-develUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub