FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfree…

FreeRDP versions before 3.29.0 contain a client-side heap use-after-free vulnerability in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled. The flaw exists in update_message_WindowIcon() where a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with a parser-owned pointer. After the parser callback returns, the original iconInfo is freed, but the queued async message retains and later dispatches the stale pointer. A malicious or compromised RDP server can exploit this by sending a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON. Successful exploitation leads to memory corruption and client crash. The vulnerability is triggered only when the /async-update flag is used (e.g., xfreerdp /async-update). A fix has been committed to the FreeRDP GitHub repository and is included in version 3.29.0.