Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s gdi_SurfaceToSurface path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
A flaw was found in FreeRDP. A malicious server can exploit a client-side heap buffer overflow vulnerability in the gdi_SurfaceToSurface path. This vulnerability, caused by a mismatch in memory handling, can lead to a crash (Denial of Service) of the client application. Furthermore, it carries a risk of heap corruption, which could potentially enable arbitrary code execution on the affected system.
Отчет
For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Will not fix | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:2222 | 09.02.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:2952 | 18.02.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:2714 | 16.02.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:2081 | 05.02.2026 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | freerdp | Fixed | RHSA-2026:3039 | 23.02.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:3038 | 23.02.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:3038 | 23.02.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:3036 | 23.02.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:3036 | 23.02.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.6 High
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость функции gdi_SurfaceToSurface() RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код и вызвать отказ в обслуживании
7.6 High
CVSS3