CVE-2026-125394

FreeRDP versions prior to 3.33.0 are vulnerable to a heap use-after-free vulnerability within the functions update_gdi_patblt(), update_gdi_polygon_cb(), and update_gdi_mem3blt(). The root cause is the retention of stale brush cache pointers . A malicious RDP server can exploit this by resending ...

CVE-2026-125394 FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt, updategdipolygoncb and updategdimem3blt that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory,...