Описание
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow, potentially enabling arbitrary code execution on systems using the ALSA backend, or a denial of service across all supported platforms.
Отчет
This is a flaw in FreeRDP that could lead to remote code execution or denial of service on client systems. The vulnerability arises from an integer overflow in the audio input redirection channel (audin) when connecting to a malicious RDP server, which can cause a heap-based buffer overflow, particularly affecting Linux systems using the ALSA backend. Exploitation requires user interaction to connect to a compromised server.
Меры по смягчению последствий
To mitigate this issue, disable the audio input redirection channel when using FreeRDP clients. This can be achieved by using the /audin:no command-line option when launching xfreerdp or other FreeRDP-based clients. Disabling audio input redirection may impact functionality that relies on microphone input during the RDP session. Ensure to restart any active FreeRDP sessions for the change to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:54486 | 13.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | freerdp | Fixed | RHSA-2026:58711 | 24.08.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:62401 | 02.09.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:54485 | 13.08.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:60173 | 26.08.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:60173 | 26.08.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:61250 | 31.08.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:61250 | 31.08.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:61251 | 31.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the ...
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
Уязвимость RDP-клиента FreeRDP, связанная с переполнением буфера в динамической памяти, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3