CVE-2026-67300 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP before version 3.29.0, particularly those with RDP servers exposed to untrusted users, should prioritize updating to the latest version to mitigate the client-side heap use-after-free vulnerabilities. This includes reviewing compensating controls for exposed systems and monitoring RDP server activity for suspicious behavior. Security teams should also review their asset inventory and consider rollback/change windows for remediation.

Technical summary

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. A malicious or compromised RDP server can exploit these vulnerabilities by sending crafted update orders, potentially causing memory corruption or a client crash. Organizations using FreeRDP should prioritize updating to the latest version.

Defensive priority

Organizations using FreeRDP before version 3.29.0 should prioritize updating to the latest version to mitigate the client-side heap use-after-free vulnerabilities.

Recommended defensive actions

• Update FreeRDP to version 3.29.0 or later
• Restrict access to RDP servers to trusted users
• Monitor RDP server activity for suspicious behavior
• Review compensating controls for exposed systems
• Review asset inventory and consider rollback/change windows for remediation
• Track exceptions and retest remediated assets

Evidence notes

The CVE record indicates that FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. However, detailed information about the vulnerabilities is limited in the provided source corpus. Organizations should verify their deployments, review official advisories, and consider compensating controls.

Official resources