Описание
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.
Отчет
This issue is rated Important because an authenticated RDP client can trigger a heap-based buffer overflow in the FreeRDP server audio (rdpsnd) channel without further user interaction (PR:L, UI:N), with High impact on confidentiality, integrity, and availability. The vulnerable code is in the server-side rdpsnd path shipped when FreeRDP server components (for example freerdp-server / freerdp-shadow-cli) are built and used. Red Hat products that ship FreeRDP with server support before 3.32.1 are affected. Platform hardening such as ASLR, NX, and FORTIFY_SOURCE may make reliable exploitation more difficult but does not remove the underlying memory-corruption risk.
Меры по смягчению последствий
If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 7 | freerdp | Affected | ||
| Red Hat Enterprise Linux 8 | freerdp | Affected | ||
| Red Hat Enterprise Linux 9 | freerdp | Affected | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:94514 | 03.11.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the ser ...
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
ELSA-2026-94514: freerdp security, bug fix, and enhancement update (IMPORTANT)
EPSS
8.8 High
CVSS3