CVE-2026-67301: freerdp Out-of-bounds Read

Vulnerability summary

CVE-2026-67301 is a high (CVSS 8.7) Out-of-bounds Read vulnerability in freerdp. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.