CVE-2026-67301
Received Received - Intake

Out-of-Bounds Read in FreeRDP

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67301
EUVD
EUVD-2026-51857

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has out-of-bounds read vulnerabilities in the async update message proxy for PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled, the functions allocate a new points array but incorrectly copy point data from the wrong memory location, causing an out-of-bounds read. A malicious RDP server could exploit this to disclose memory or crash the client.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP version and monitoring for suspicious RDP server activity. Use 'xfreerdp /version' to check installed version. If version is below 3.29.0, the system is vulnerable. Monitor network traffic for PolygonSC or PolygonCB drawing orders with AsyncUpdate enabled.

Impact Analysis

This vulnerability could allow a malicious or compromised RDP server to read sensitive memory from your system or cause your FreeRDP client to crash. If exploited, it may lead to information disclosure or denial of service on the affected client machine.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.29.0 or later. Disable AsyncUpdate in RDP clients by removing '/async-update' flag. Block or isolate untrusted RDP servers. Apply network-level mitigations to filter malformed PolygonSC/PolygonCB orders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart