Description
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FreeRDP | FreeRDP | < 3.33.0 | 3.33.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freerdp3 | No fix yet | — |
| Debian 13 | freerdp3 | No fix yet | — |
| Debian 12 | freerdp2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | freerdp | No fix yet | — |
| Ubuntu 16.04 LTS | freerdp | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
D7EAD/CVE-2026-125394 ★ 1 · Nov 10, 2026
FreeRDP before 3.33.0 contains a heap UAF vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-4265 FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 9, 2026
References
- GitHub Security Advisory (GHSA-fw6x-h8gw-778w) vendor-advisory
- https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832 patch
- FreeRDP 3.33.0 Release Notes release-notes
- https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80 technical-description
- VulnCheck Advisory: FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer third-party-advisory