Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-31806

Опубликовано: 13 мар. 2026
Источник: redhat
CVSS3: 8.8
EPSS Низкий

Описание

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The gdi_surface_bits() function, which processes SURFACE_BITS_COMMAND messages, does not properly validate image dimensions (bmp.width and bmp.height) provided by a malicious RDP server. This can lead to a heap buffer overflow during bitmap decoding and memory operations. A remote attacker could exploit this to overwrite adjacent memory, potentially resulting in arbitrary code execution.

Отчет

For this vulnerability to be exploited, a susceptible system must connect to a malicious server. For that reason, Red Hat recommends that you only use FreeRDP to connect to trusted servers.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6freerdpNot affected
Red Hat Enterprise Linux 10freerdpFixedRHSA-2026:679907.04.2026
Red Hat Enterprise Linux 10freerdpFixedRHSA-2026:1903319.05.2026
Red Hat Enterprise Linux 10.0 Extended Update SupportfreerdpFixedRHSA-2026:674307.04.2026
Red Hat Enterprise Linux 7 Extended Lifecycle SupportfreerdpFixedRHSA-2026:1132328.04.2026
Red Hat Enterprise Linux 8freerdpFixedRHSA-2026:691807.04.2026
Red Hat Enterprise Linux 8.2 Advanced Update SupportfreerdpFixedRHSA-2026:1073427.04.2026
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportfreerdpFixedRHSA-2026:1073527.04.2026
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnfreerdpFixedRHSA-2026:1073527.04.2026
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportfreerdpFixedRHSA-2026:1095127.04.2026

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-131
https://bugzilla.redhat.com/show_bug.cgi?id=2447376freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages

EPSS

Процентиль: 48%
0.00656
Низкий

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 9.8
ubuntu
5 месяцев назад

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

CVSS3: 9.8
nvd
5 месяцев назад

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

CVSS3: 9.8
debian
5 месяцев назад

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...

CVSS3: 8.8
fstec
5 месяцев назад

Уязвимость функции gdi_surface_bits() RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код

CVSS3: 8.8
redos
около 1 месяца назад

Уязвимость freerdp3

EPSS

Процентиль: 48%
0.00656
Низкий

8.8 High

CVSS3