FREERDP · CVE-2026-125394 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP before 3.33.0 has a heap use-after-free in its GDI drawing code, where stale brush cache pointers are reused after the slot is refilled. A malicious RDP server can trigger it to make the client read freed memory, leaking data or crashing.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application or machine that uses FreeRDP as an RDP client and connects to a server it does not fully trust is exposed. Servers only acting as RDP hosts, or clients connecting only to trusted internal RDP servers, are at much lower risk. Teams that never run FreeRDP clients can skip it.
Not affected if freerdp-not-used, trusted-servers-only
Who cares c, freerdp, rdp, remote-desktop
xfreerdp /version or the installed package version3.33.0 as exposed3.33.0 or laterFreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.