FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-libs-debuginfo | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-server-debuginfoNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinpr | Aug 5, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade libwinpr | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub