CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.29.0 are vulnerable to client-side heap use-after-free issues in the async update message proxy, specifically affecting RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. An attacker controlling an RDP server can exploit this vulnerability by sending crafted update orders, leading to potential memory corruption or crashes on the client side. Organizations using FreeRDP should prioritize patching this vulnerability to mitigate risks associated with remote desktop sessions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.