CVE-2026-67301 FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

High 8.7 Published 1 Aug 2026 Updated 3 Aug 2026

A malicious RDP server can trigger an out-of-bounds read in FreeRDP clients, leading to memory disclosure or crashes when async updates are enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-67301?

CVE-2026-67301 is a high-severity memory corruption vulnerability in Freerdp Freerdp, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

Weakness: CWE-125

Which versions are affected by CVE-2026-67301?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-67301?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-67301 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67301 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as CLSA-2026-1789779158, CLSA-2026-1789779650, DEBIAN-CVE-2026-67301, GHSA-vpv4-cm44-pgmc, GHSA-vxp3-7g6q-rq2w, UBUNTU-CVE-2026-67301.