CVE-2026-67299 FreeRDP CVE debrief

Who should care

Users of FreeRDP, especially those enabling AsyncUpdate, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating FreeRDP configurations, restricting access to RDP services, and implementing compensating controls such as network segmentation. Security teams should monitor for suspicious RDP activity and prioritize patching to prevent potential client crashes and memory corruption. Vulnerability management and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Operators of affected systems should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested, with the item only closed after evidence is documented. Asset inventory and security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Rollback/change windows should be considered for patching and mitigation efforts. Source tracking should be implemented to monitor for potential exploitation attempts. The debrief provides an executive overview of the vulnerability, highlighting the affected product, vulnerability class, likely operational impact, and source-confidence limits. The technical summary provides a detailed analysis of the vulnerability, including affected product context, defensive impact, and source-grounded technical framing. The evidence notes provide additional context and limitations of the available information. The recommended actions provide guidance on mitigating the vulnerability and reducing the risk of exploitation. The defensive priority highlights the importance of patching and implementing compensating controls to prevent potential client crashes and memory corruption. The who should care section provides guidance on which teams and individuals should be aware of the vulnerabil

Technical summary

CVE-2026-67299 is a client-side heap use-after-free vulnerability in FreeRDP before version 3.29.0. The vulnerability occurs in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled. A malicious RDP server can trigger the use-after-free by sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON, leading to memory corruption and client crashes. FreeRDP users should prioritize patching to prevent potential client crashes and memory corruption.

Defensive priority

FreeRDP users should prioritize patching to prevent potential client crashes and memory corruption.

Recommended defensive actions

• Apply patches or updates to FreeRDP to version 3.29.0 or later
• Restrict access to RDP services until patching can be performed
• Monitor for suspicious RDP activity
• Implement compensating controls such as network segmentation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-67299 record indicates a client-side heap use-after-free in FreeRDP before version 3.29.0. The vulnerability is triggered by a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON when AsyncUpdate is enabled. Limited information is available about affected scope and vendor remediation efforts. Users should verify FreeRDP versions, review AsyncUpdate configurations, and monitor for suspicious RDP activity.

Official resources