CVE-2026-67300

A flaw was found in FreeRDP. This client-side heap use-after-free vulnerability occurs when a malicious or compromised Remote Desktop Protocol (RDP) server sends specially crafted update orders. The async update message proxy incorrectly handles memory by shallow-copying structures with pointers that are later freed by the parser. This leads to the use of stale pointers, which can cause memory corruption or a client crash, resulting in a denial of service.

This issue is classified as Moderate severity because exploitation requires a user to connect to a malicious or compromised RDP server, where crafted update orders can trigger a client-side heap use-after-free resulting in an application crash or memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid connecting to untrusted RDP servers. Additionally, if possible, disable the AsyncUpdate feature in FreeRDP clients to prevent the vulnerable code path from being exercised. Consult FreeRDP documentation for specific configuration options to disable AsyncUpdate.