PT-2026-141217

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update gdi patblt, update gdi polygon cb and update gdi mem3blt that retain stale brush cache pointers. A malicious RDP server can resend CACHE BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory,...