THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67299 (HIGH 7.5) — FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInf

[NVD] CVE-2026-67299 (HIGH 7.5) — FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInf

mednvdPublished 2026-08-01

CVE-2026-67299 CVSS: 7.5 HIGH Published: 2026-08-01T13:16:59.250

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer.

Indicators of compromise

CVE-2026-67299cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67299