The vulnerability in FreeRDP before version 3.29.0 involves out-of-bounds reads in the async update message proxy for PolygonSC and PolygonCB primary drawing orders. Specifically, when async update is enabled (e.g., using the xfreerdp /async-update option), the functions update_message_PolygonSC() and update_message_PolygonCB() allocate a new points array but erroneously copy point data from the address of the order structure rather than from the intended polygonSC->points or polygonCB->points arrays. This results in client-side out-of-bounds memory reads. A malicious or compromised RDP server can exploit this by sending crafted PolygonSC/PolygonCB update orders, which may lead to memory disclosure or cause the client to crash.

Exploitation of this vulnerability allows a malicious or compromised RDP server to cause out-of-bounds reads on the client side. This can lead to memory disclosure or client crashes, impacting availability and potentially exposing sensitive memory contents. There is no indication of confidentiality or integrity impact beyond memory disclosure and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects FreeRDP versions before 3.29.0, upgrading to version 3.29.0 or later is expected to address the issue once an official fix is released. Until then, avoid enabling async update mode or connecting to untrusted RDP servers with async update enabled.