Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol (RDP) response. This occurs because the client incorrectly uses a smaller alloc_hint value instead of the actual StubLength for buffer capacity during response reassembly. This allows attacker-controlled data to be written beyond the intended buffer, leading to a client crash and potentially enabling arbitrary code execution.
Отчет
A heap buffer overflow flaw was found in FreeRDP's TS Gateway RPC client (libfreerdp/core/gateway/rpc_client.c). During response fragment reassembly in rpc_client_recv_fragment, stream allocation relies on the server-provided alloc_hint rather than the actual StubLength. A malicious TS Gateway can send a PTYPE_RESPONSE packet with a small alloc_hint and a larger payload, causing Stream_Write to overwrite memory beyond the fixed 4096-byte buffer (pdu->s). This can result in client crashes or potential arbitrary code execution.
Меры по смягчению последствий
To mitigate this vulnerability, avoid connecting through untrusted TS Gateways (RD Gateways) or disable gateway parameters (such as omitting /g: in xfreerdp) to force direct RDP connections and bypass RPC response parsing.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:61378 | 31.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:68706 | 17.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:68707 | 17.09.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:62571 | 02.09.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:65855 | 09.09.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:65855 | 09.09.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:66281 | 10.09.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:66281 | 10.09.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:66282 | 10.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
Уязвимость функции rpc_client_recv_fragment() файла libfreerdp/core/gateway/rpc_client.c RDP-клиента FreeRDP, позволяющая нарушителю вызвать отказ в обслуживании и выполнить произвольный код
EPSS
8.8 High
CVSS3