CVE-2026-125394

Description

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w ↗
• https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832 ↗
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0 ↗
• https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80 ↗
• https://www.vulncheck.com/advisories/freerdp-before-3.33.0-use-after-free-via-stale-brush-cache-pointer ↗