CVE-2026-125394

freerdp: FreeRDP: Information disclosure via stale brush cache use-after-free

freerdp

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.

10. Nov 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• NVD
  CVE-2026-125394