CVE-2026-125394FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer

Beschreibung

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-fw6x-h8gw-778w) vendor-advisory
• https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832 patch
• FreeRDP 3.33.0 Release Notes release-notes
• https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80 technical-description
• VulnCheck Advisory: FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer third-party-advisory