PT-2026-141217
CVE-2026-125394
·
Published
2026-11-09
·
Updated
2026-11-10
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update gdi patblt(), update gdi polygon cb() and update gdi mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Found an issue in the description? Have something to add? Feel free to write us 👾