CVE-2026-67299

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol (RDP) server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memory corruption, leading to a client crash and a denial of service.

This is a Moderate client-side flaw in FreeRDP. When a user connects to a malicious RDP server with asynchronous updates explicitly enabled, a heap use-after-free vulnerability can be triggered. This leads to memory corruption and a denial of service on the client system, but requires user interaction with a compromised server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid connecting to untrusted RDP servers. Additionally, refrain from using the /async-update command-line option when launching FreeRDP clients, as this feature is required to trigger the vulnerability.