Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_SetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xf_rail_get_window in xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
A flaw was found in FreeRDP. A remote attacker could exploit a use-after-free vulnerability in the xf_SetWindowMinMaxInfo function. This occurs when a freed window pointer is dereferenced because the main thread concurrently deletes a window while the Remote Desktop Protocol (RAIL) channel thread is still using the pointer. This flaw can lead to a denial of service.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Affected | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:16014 | 11.05.2026 |
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:19142 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:20605 | 26.05.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:20546 | 26.05.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:16019 | 11.05.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:19811 | 20.05.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:19811 | 20.05.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:16814 | 13.05.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:16814 | 13.05.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.4 Medium
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость функций xf_SetWindowMinMaxInfo(), xf_rail_get_window() RDP-клиента FreeRDP , позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
EPSS
6.4 Medium
CVSS3