CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.

• CWE-125

• https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493fPatch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2wExploit, Vendor Advisory
• https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-polygon-async-message-proxyPatch, Third Party Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vxp3-7g6q-rq2wExploit, Vendor Advisory

Published

Aug 1, 2026

Last Modified

Sep 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67296FreeRDP before 3.29.0 contains a denial of service vulnerabi…7.5
• CVE-2026-67297FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIM…7.5
• CVE-2026-67298FreeRDP versions 3.28.0 and earlier contain a heap buffer ov…7.5
• CVE-2026-67299FreeRDP before 3.29.0 contains a client-side heap use-after-…7.5
• CVE-2026-6730IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer ov…9.8
• CVE-2026-67300FreeRDP before 3.29.0 contains client-side heap use-after-fr…7.5
• CVE-2026-67302FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…6.5
• CVE-2026-67303FreeRDP before 3.29.0 contains a reachable assertion (WINPR_…4.3
• CVE-2026-67304FreeRDP before 3.29.0 contains a null pointer dereference vu…7.5
• CVE-2026-67305FreeRDP Windows client before 3.29.0 contains a heap buffer …8.8
• CVE-2026-67306FreeRDP versions 3.28.0 and earlier contain an out-of-bounds…5.4
• CVE-2026-67307Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate o…7.7