Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A remote attacker could exploit a heap buffer overflow vulnerability in the resize_vbar_entry() function. This occurs when an error in buffer resizing leads to attacker-controlled pixel data being written into an undersized memory buffer. Successful exploitation could result in arbitrary code execution.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 7 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:8458 | 16.04.2026 |
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:19033 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:11333 | 28.04.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:8945 | 20.04.2026 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | freerdp | Fixed | RHSA-2026:11651 | 29.04.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:11649 | 29.04.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:11649 | 29.04.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:12388 | 30.04.2026 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость функции resize_vbar_entry() RDP-клиента FreeRDP, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
7.5 High
CVSS3