CVE-2026-125394

EUVD-2026-120557
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 11.5%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
freerdpfreerdp
𝑥
< 3.33.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
vulnerable
freerdp3
forky
vulnerable
sid
3.33.1+dfsg-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80
https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832
https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w
https://www.vulncheck.com/advisories/freerdp-before-3.33.0-use-after-free-via-stale-brush-cache-pointer