FreeRDP versions before 3.29.0 are affected by out-of-bounds read vulnerabilities in the async update message proxy for PolygonSC and PolygonCB primary drawing orders. The flaw occurs when AsyncUpdate is enabled, causing update_message_PolygonSC() and update_message_PolygonCB() to copy point data from the wrong memory address. Instead of reading from polygonSC->points or polygonCB->points, data is copied from the address of the order structure itself. A malicious or compromised RDP server can exploit this by sending crafted PolygonSC/PolygonCB update orders to the client. The impact includes potential memory disclosure and client-side crashes. The vulnerability is client-side, requiring the client to connect to a malicious RDP server with AsyncUpdate enabled. A fix is available in FreeRDP 3.29.0, with the patch referenced in the official GitHub commit.