Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
A flaw was found in FreeRDP. A malicious server can exploit a heap use-after-free or double-free vulnerability in the FreeRDP client's RDPEAR authentication-redirection path. This occurs because the RDPEAR NDR parser incorrectly handles pointer reference IDs, leading to the same heap object being assigned to multiple pointer fields. This flaw could allow a remote attacker to execute arbitrary code or cause a denial of service on the client system.
Отчет
A critical FreeRDP flaw in the RDPEAR path incorrectly handles pointer reference IDs. If a user connects to a malicious server, it can trigger a heap use-after-free or double-free, causing arbitrary code execution or a denial of service (DoS).
Меры по смягчению последствий
To mitigate this risk, avoid connecting to untrusted RDP servers and use firewall rules to restrict FreeRDP clients to trusted servers. If FreeRDP is not needed, remove the package to eliminate the attack vector, though this may affect dependent applications.
To remove the package:
sudo dnf remove freerdp
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 7 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 8 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 9 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:36203 | 07.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:46393 | 27.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость парсера RDPEAR NDR RDP-клиента FreeRDP, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3