CVE-2026-67300

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.

• CVE-2026-68580: reject a FramesPerPacket of INT32_MAX or more in audin_process_open() before it is stored, so a malicious server cannot overflow the per-packet size arithmetic in the audio input backends
• CVE-2026-66402: return the real length of certificate ASN.1 strings and reject values that are not a host name or IP, so a certificate carrying an embedded NUL can no longer pass identity validation as a shorter, different name
• CVE-2026-67300: deep-clone WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER before posting them to the async update queue, and free the clone in the message destructor; the shallow copies referenced parser-owned heap released as soon as the callback returned
• CVE-2026-67289: validate the server-supplied redirection fields - addresses must parse as IPv4/IPv6, FQDN and NetBIOS name must look like a host, username and domain must not contain line breaks - so CRLF in TargetNetAddress can no longer be injected into the HTTP proxy CONNECT request

• CVE-2026-68580: reject a FramesPerPacket of INT32_MAX or more in audin_process_open() before it is stored, so a malicious server cannot overflow the per-packet size arithmetic in the audio input backends
• CVE-2026-66402: return the real length of certificate ASN.1 strings and reject values that are not a host name or IP, so a certificate carrying an embedded NUL can no longer pass identity validation as a shorter, different name
• CVE-2026-67300: deep-clone WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER before posting them to the async update queue, and free the clone in the message destructor; the shallow copies referenced parser-owned heap released as soon as the callback returned
• CVE-2026-67289: validate the server-supplied redirection fields - addresses must parse as IPv4/IPv6, FQDN and NetBIOS name must look like a host, username and domain must not contain line breaks - so CRLF in TargetNetAddress can no longer be injected into the HTTP proxy CONNECT request