CVE-2026-67301 | BDVDB-2026-354586 Detail

Description#

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-01Record published in the CVE List.
2. Version 22026-08-03Most recent update recorded in the CVE List.