5.4Media
CVE-2026-125394FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer
Descripción
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Debilidad (CWE):
CWE-416
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
Referencias y parches
- GitHub Security Advisory (GHSA-fw6x-h8gw-778w) vendor-advisory
- https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832 patch
- FreeRDP 3.33.0 Release Notes release-notes
- https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80 technical-description
- VulnCheck Advisory: FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer third-party-advisory