CVE-2026-67301 is a memory disclosure vulnerability in FreeRDP's client-side async update handling. The bug manifests in the PolygonSC and PolygonCB order handlers, where a points array is allocated with the correct size but the code reads from the order structure's base address rather than the actual polygon data pointer. This is not a buffer overflow — the allocation is semantically correct — but a pointer inversion where the source address is wrong. The result is a controlled out-of-bounds read from client heap memory, with the read offset determined by the malicious server's crafted polygon order.
The vulnerability is exploitable only when the FreeRDP client connects with the /async-update flag (or equivalent configuration). This flag enables a performance optimization that duplicates synchronous update logic under different allocation semantics — handlers allocate fresh buffers and copy data rather than reading directly from the order structure. The catch: this architectural divergence creates conditions for systematic semantic errors. PolygonSC and PolygonCB both exhibit the same inversion pattern — correct allocation shape, wrong source pointer — suggesting the async handler scaffolding itself may contain a recurring template flaw. FreeRDP has had at least two prior async-update handler bugs with this exact structural fingerprint, indicating this is not an isolated incident but a class of vulnerability in the async update surface.
The practical severity depends heavily on deployment context. FreeRDP is embedded in enterprise thin client firmware, security assessment tools, and automated testing harnesses where /async-update may be baked into wrapper configurations. If your environment uses FreeRDP as a backend for RDP-based security tooling or automated access systems, the async update path may be enabled without explicit user awareness. The CVSS 7.5 undersells this — a reliable heap memory disclosure from an active RDP session can expose session tokens, cached credentials, or other heap-allocated client state adjacent to the order structure. A compromised or MITM'd RDP server can drip crafted PolygonSC/PolygonCB orders across connected clients and harvest whatever lies in adjacent heap memory.
Prioritise these actions: First, audit any FreeRDP deployments for /async-update usage — check wrapper scripts, thin client configs, and security tool backends. Second, upgrade to FreeRDP 3.29.0 which patches PolygonSC and PolygonCB. Third, treat this as a signal to audit other async update handlers; the same semantic inversion pattern likely exists in undiscovered handlers. Finally, assume that any compromised RDP server targeting FreeRDP clients can harvest session state — the threat model must invert to account for malicious servers, not just untrusted networks.