CVE-2026-67301 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP before 3.29.0 should prioritize patching or updating to address the out-of-bounds read vulnerabilities. Additionally, RDP server administrators should review and update their configurations to prevent malicious or compromised servers from sending crafted PolygonSC/PolygonCB update orders.

Technical summary

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled, update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Defensive priority

High-priority defensive actions are required to address the out-of-bounds read vulnerabilities in FreeRDP before 3.29.0.

Recommended defensive actions

• Inventory and verify FreeRDP installations to identify potential vulnerabilities.
• Apply patches or updates to FreeRDP to address the out-of-bounds read vulnerabilities.
• Implement compensating controls, such as monitoring and exception tracking, to detect and respond to potential attacks.
• Review and update RDP server configurations to prevent malicious or compromised servers from sending crafted PolygonSC/PolygonCB update orders.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates that FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash. Evidence is limited, and further verification is required to determine the full scope of the vulnerability.

Official resources