{"id":"CVE-2026-125394","kind":"vulnerability","aliases":["CVE-2026-125394"],"related":[],"title":"FreeRDP: stale brush cache pointers let a malicious server crash clients","description":"FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.","summary":"FreeRDP before 3.33.0 has a heap use-after-free in its GDI drawing code, where stale brush cache pointers are reused after the slot is refilled. A malicious RDP server can trigger it to make the client read freed memory, leaking data or crashing.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FreeRDP","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c","freerdp","package","rdp","remote-desktop"],"not_affected_if":["freerdp-not-used","trusted-servers-only"],"how_to_check":"- Check the FreeRDP version on the client with `xfreerdp /version` or the installed package version\n- Treat any version below `3.33.0` as exposed\n- Identify clients that connect to RDP servers you do not control","fix":"- FreeRDP: upgrade to `3.33.0` or later","status":"open","published_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:30:25+00:00","updated_at":"2026-11-10T00:30:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T00:30:25Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: upgrade to `3.33.0` or later","reach":"network","title":"FreeRDP: stale brush cache pointers let a malicious server crash clients","impact":"medium","summary":"FreeRDP before 3.33.0 has a heap use-after-free in its GDI drawing code, where stale brush cache pointers are reused after the slot is refilled. A malicious RDP server can trigger it to make the client read freed memory, leaking data or crashing.","audience":"developers","category":"package","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop","c"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"client memory disclosed or client process crashes","analyst_note":"Confirm the fixed version and whether the fix is in the release notes at the linked GitHub release page; check whether user interaction is required.","how_to_check":"- Check the FreeRDP version on the client with `xfreerdp /version` or the installed package version\n- Treat any version below `3.33.0` as exposed\n- Identify clients that connect to RDP servers you do not control","plain_action":"","product_name":"FreeRDP","needs_analyst":true,"not_affected_if":["freerdp-not-used","trusted-servers-only"],"who_is_affected":"Any application or machine that uses FreeRDP as an RDP client and connects to a server it does not fully trust is exposed. Servers only acting as RDP hosts, or clients connecting only to trusted internal RDP servers, are at much lower risk. Teams that never run FreeRDP clients can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000768,"input_tokens":4674,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125394':14A,17A '-2026':13A,16A '3.33.0':28B,73C 'brush':3A,43B,97C,107C 'c':19B 'cach':4A,44B,98C,106C 'caus':115C 'cb':89C 'client':11A,63B,116C 'code':40B 'contain':74C 'crash':10A,70B,125C 'cve':12A,15A 'data':68B,123C 'desktop':25B 'disclos':122C 'draw':39B 'free':35B,80C 'freed':65B,119C 'freerdp':1A,18A,20B,26B,71C 'gdi':38B,84C,87C,92C 'heap':31B,76C,120C 'leak':67B 'let':6A 'make':61B 'malici':8A,54B,101C 'mem3blt':93C 'memori':66B,121C 'packag':21B 'patblt':85C,114C 'pointer':5A,45B,99C 'polygon':88C 'rdp':22B,55B,102C 'read':64B,118C 'refil':52B 'remot':24B 'remote-desktop':23B 'resend':105C 'retain':95C 'reus':47B 'send':113C 'server':9A,56B,103C 'slot':50B,111C 'stale':2A,42B,96C 'trigger':58B 'updat':83C,86C,91C 'use':33B,78C 'use-after-fre':32B,77C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Any application or machine that uses FreeRDP as an RDP client and connects to a server it does not fully trust is exposed. Servers only acting as RDP hosts, or clients connecting only to trusted internal RDP servers, are at much lower risk. Teams that never run FreeRDP clients can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["freerdp"],"ptokens":["freerdp"],"labels":["c","freerdp","medium","package","rdp","remotedesktop","vendor"],"campaign_type":null,"search_a":"'-125394':14A,17A '-2026':13A,16A 'brush':3A 'cach':4A 'client':11A 'crash':10A 'cve':12A,15A 'freerdp':1A,18A 'let':6A 'malici':8A 'pointer':5A 'server':9A 'stale':2A","search_b":"'3.33.0':28B 'brush':43B 'c':19B 'cach':44B 'client':63B 'code':40B 'crash':70B 'data':68B 'desktop':25B 'draw':39B 'free':35B 'freed':65B 'freerdp':20B,26B 'gdi':38B 'heap':31B 'leak':67B 'make':61B 'malici':54B 'memori':66B 'packag':21B 'pointer':45B 'rdp':22B,55B 'read':64B 'refil':52B 'remot':24B 'remote-desktop':23B 'reus':47B 'server':56B 'slot':50B 'stale':42B 'trigger':58B 'use':33B 'use-after-fre':32B","search_c":"'3.33.0':73C 'brush':97C,107C 'cach':98C,106C 'caus':115C 'cb':89C 'client':116C 'contain':74C 'crash':125C 'data':123C 'disclos':122C 'free':80C 'freed':119C 'freerdp':71C 'gdi':84C,87C,92C 'heap':76C,120C 'malici':101C 'mem3blt':93C 'memori':121C 'patblt':85C,114C 'pointer':99C 'polygon':88C 'rdp':102C 'read':118C 'resend':105C 'retain':95C 'send':113C 'server':103C 'slot':111C 'stale':96C 'updat':83C,86C,91C 'use':78C 'use-after-fre':77C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:35:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125394","severity":null,"published_at":"2026-11-10T00:17:13+00:00","modified_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111584,"url":"https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111585,"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111586,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T13:35:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111587,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.33.0-use-after-free-via-stale-brush-cache-pointer","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}