CVE-2026-125394— FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer

Quick assessment

Affected

FreeRDP FreeRDP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeRDP 3.33.0 之前的版本在、和函数中存在堆释放后使用（heap use-after-free）漏洞，原因是这些函数保留了过时的画笔缓存指针。恶意 RDP 服务器可向同一槽位重新发送，随后发送指令，导致客户端读取已被释放的堆内存，从而造成数据泄露或程序崩溃。

CVSS 5.4 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer

Source: CVE Program / CVE List V5

Vulnerability Description

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FreeRDP	FreeRDP	0 ~ 3.33.0	-

II. Public POCs for CVE-2026-125394

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125394

请登录查看更多情报信息。

Other References for CVE-2026-125394 (5)

https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80 technical-description
https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832 patch
https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0 release-notes
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.33.0-use-after-free-via-stale-brush-cache-pointer third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125394

IV. Related Vulnerabilities

Same product: FreeRDP

Same vendor: FreeRDP

Same weakness: CWE-416