FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STA…

FreeRDP versions before 3.29.0 contain client-side heap use-after-free vulnerabilities in the async update message proxy. The flaws affect RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER processing when AsyncUpdate is enabled. A malicious or compromised RDP server can send crafted update orders that trigger the vulnerability. The message proxy performs shallow copies of structures containing nested parser-owned pointers such as titleInfo.string, windowRects, visibilityRects, and icon buffers. After the callback returns, the parser frees those nested buffers, leaving the queued async message with stale dangling pointers. When the async message is later dispatched, it accesses freed memory, potentially leading to memory corruption or a client crash. The fix is available in FreeRDP 3.29.0 and is documented in a GitHub security advisory and commit.