CVE-2026-67301

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol (RDP) server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to crash, resulting in a Denial of Service.

A Moderate out-of-bounds read flaw in FreeRDP allows a malicious server to cause memory disclosure or crash the client, but only when the non-default async-update feature is explicitly enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid enabling the async-update feature when using FreeRDP clients. This feature is not enabled by default. If xfreerdp is used, ensure the /async-update command-line option is not specified. Disabling this feature may impact performance in certain RDP sessions where asynchronous updates are beneficial.