Описание
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.
A flaw was found in FreeRDP. A malicious RDP (Remote Desktop Protocol) server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU (Protocol Data Unit) with an oversized LB_LOAD_BALANCE_INFO field, an attacker could cause a denial of service or heap corruption on the client system.
Меры по смягчению последствий
To prevent exploitation of this heap buffer overflow, FreeRDP clients should only be used to connect to trusted RDP servers. This operational control reduces the risk of encountering a malicious server redirection PDU.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:75570 | 05.10.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:93559 | 02.11.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:76747 | 06.10.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:93538 | 02.11.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:93538 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:93549 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:93549 | 02.11.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:93537 | 02.11.2026 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | freerdp | Fixed | RHSA-2026:93537 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerab ...
EPSS
6.5 Medium
CVSS3