CVE-2026-67301— FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
Possible ATT&CK Techniques 1AI
T1115 · Clipboard DataGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-67301
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
FreeRDP 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeRDP是FreeRDP团队开源的一款远程桌面协议(RDP)的实现。 FreeRDP 3.29.0之前版本存在安全漏洞，该漏洞源于异步更新消息代理中PolygonSC和PolygonCB绘图命令的越界读取，即从订单结构地址复制点数据而非points数组，可能导致内存泄露或客户端崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-67301
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7603 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-67301
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-67301 (1)
Vendor Advisories for CVE-2026-67301 (2)
Same Patch Batch · FreeRDP · 2026-08-01 · 21 CVEs total
| CVE-2026-66402 | 9.8 CRITICAL | FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass |
| CVE-2026-67289 | 9.8 CRITICAL | FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection |
| CVE-2026-67305 | 9.4 CRITICAL | FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr |
| CVE-2026-67299 | 7.5 HIGH | FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message |
| CVE-2026-67304 | 7.5 HIGH | FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup |
| CVE-2026-67297 | 7.5 HIGH | FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response |
| CVE-2026-67290 | 7.5 HIGH | FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF |
| CVE-2026-67296 | 7.5 HIGH | FreeRDP before 3.29.0 Denial of Service via RDPEI PDU |
| CVE-2026-67291 | 7.5 HIGH | FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD |
| CVE-2026-67300 | 7.5 HIGH | FreeRDP before 3.29.0 Use-After-Free via async message proxy |
| CVE-2026-67288 | 7.5 HIGH | FreeRDP before 3.29.0 Denial of Service via smartcard cache |
| CVE-2026-67298 | 7.5 HIGH | FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow |
| CVE-2026-67292 | 6.5 MEDIUM | FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure |
| CVE-2026-67295 | 6.3 MEDIUM | FreeRDP before 3.29.0 Path Traversal via drive redirection |
| CVE-2026-67294 | 5.9 MEDIUM | FreeRDP before 3.29.0 TLS Certificate EKU Bypass |
| CVE-2026-67306 | 5.4 MEDIUM | FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE |
| CVE-2026-67303 | 4.3 MEDIUM | FreeRDP before 3.29.0 Denial of Service via serial DeviceControl |
| CVE-2026-67302 | 4.3 MEDIUM | FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service |
| CVE-2026-67293 | 4.2 MEDIUM | FreeRDP before 3.29.0 Improper Certificate Hostname Validation |
| CVE-2026-66401 | 2.1 LOW | FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 |
IV. Related Vulnerabilities
Same product: FreeRDP
- CVE-2026-68580
FreeRDP before 3.29.0 Integer Overflow via Audio Input Chann - CVE-2026-68579
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read - CVE-2026-66401
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 - CVE-2026-67298
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Und - CVE-2026-67288
FreeRDP before 3.29.0 Denial of Service via smartcard cache
Same vendor: FreeRDP
- CVE-2026-68580
FreeRDP before 3.29.0 Integer Overflow via Audio Input Chann - CVE-2026-68579
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read - CVE-2026-67298
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Und - CVE-2026-67288
FreeRDP before 3.29.0 Denial of Service via smartcard cache - CVE-2026-66401
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264
V. Comments for CVE-2026-67301
No comments yet