Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves gdi->drawing pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit this vulnerability when a client connects to it. Specifically, offscreen bitmap deletion can lead to a use-after-free (UAF) condition, where the client attempts to use memory that has already been deallocated. This can cause a crash, resulting in a Denial of Service (DoS), and potentially lead to heap corruption with a risk of arbitrary code execution.
Отчет
For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Will not fix | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:2222 | 09.02.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:2952 | 18.02.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:2714 | 16.02.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:2081 | 05.02.2026 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | freerdp | Fixed | RHSA-2026:3039 | 23.02.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:3038 | 23.02.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:3038 | 23.02.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:3036 | 23.02.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:3036 | 23.02.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.6 High
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость функции gdi_set_bounds() RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код и вызвать отказ в обслуживании
7.6 High
CVSS3