Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, clear_decompress calls freerdp_image_copy_no_overlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
A flaw was found in FreeRDP. A malicious server can exploit an out-of-bounds read/write vulnerability in the ClearCodec component by sending crafted RDPGFX surface updates. This can trigger a client-side heap buffer overflow, leading to a crash (Denial of Service (DoS)) and potential heap corruption with a risk of arbitrary code execution. For this vulnerability to be exploited, a client must connect to a maliciously-configured server.
Отчет
For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Will not fix | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:2222 | 09.02.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:2952 | 18.02.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:2714 | 16.02.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:2081 | 05.02.2026 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | freerdp | Fixed | RHSA-2026:3039 | 23.02.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:3038 | 23.02.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:3038 | 23.02.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:3036 | 23.02.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:3036 | 23.02.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.6 High
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость функции clear_decompress() RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код и вызвать отказ в обслуживании
EPSS
7.6 High
CVSS3