Bug 2510645

Summary: CVE-2026-67299 freerdp2: FreeRDP: Denial of Service via crafted WindowIcon async message [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Srikanth Balasubramanian <sbalasub>
Component: freerdp2Assignee: Neal Gompa <ngompa13>
Status: MODIFIED --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: negativo17, ngompa13, oholy, tdawson
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8139e50b-3467-4db8-9ec7-51412e0a7f87"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2509985    

Description Srikanth Balasubramanian 2026-08-03 13:51:58 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption and client crash.
Comment 1 Fedora Update System 2026-09-01 13:28:39 UTC 
FEDORA-EPEL-2026-1c4570b861 (freerdp2-2.11.7-7.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1c4570b861