Описание
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.
A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC (Remote Procedure Call) gateway transport parser by sending a malicious BIND_ACK Protocol Data Unit (PDU) with a truncated result entry. This can lead to a process abort, resulting in a Denial of Service (DoS).
Меры по смягчению последствий
To mitigate this issue, restrict network access to any FreeRDP instance operating in a server or gateway role, limiting connections to trusted clients or networks. If FreeRDP is used as a client, avoid connecting to untrusted or malicious RDP servers to prevent exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Out of support scope | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:75570 | 05.10.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | freerdp | Fixed | RHSA-2026:93559 | 02.11.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:76747 | 06.10.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:93538 | 02.11.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:93538 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | freerdp | Fixed | RHSA-2026:93549 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | freerdp | Fixed | RHSA-2026:93549 | 02.11.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | freerdp | Fixed | RHSA-2026:93537 | 02.11.2026 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | freerdp | Fixed | RHSA-2026:93537 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the ...
EPSS
6.5 Medium
CVSS3