Описание
Security update for freerdp
This update for freerdp fixes the following issues:
- CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted
WIRE_TO_SURFACE_2PDU (bsc#1258919). - CVE-2026-25942: Global-buffer-overflow in
xf_rail_server_execute_result(bsc#1258920). - CVE-2026-25952: Heap-use-after-free in
xf_SetWindowMinMaxInfo(bsc#1258921). - CVE-2026-25953: Heap-use-after-free in
xf_AppUpdateWindowFromSurface(bsc#1258923). - CVE-2026-25954: Heap-use-after-free in
xf_rail_server_local_move_size(bsc#1258924). - CVE-2026-25955: Heap-use-after-free in
xf_AppUpdateWindowFromSurface(bsc#1258973). - CVE-2026-25959: Heap-use-after-free in
xf_cliprdr_provide_data_(bsc#1258976). - CVE-2026-25997: Heap-use-after-free in
xf_clipboard_format_equal(bsc#1258977). - CVE-2026-26986: Heap-use-after-free in
rail_window_free(bsc#1258967). - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable
WINPR_ASSERTabort (bsc#1258987). - CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability (bsc#1258941).
- CVE-2026-27951: Denial of service via endless blocking loop in
Stream_EnsureCapacity(bsc#1258939). - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
- CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
- CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
- CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Workstation Extension 15 SP7
Ссылки
- Link for SUSE-SU-2026:1633-1
- E-Mail link for SUSE-SU-2026:1633-1
- SUSE Security Ratings
- SUSE Bug 1258919
- SUSE Bug 1258920
- SUSE Bug 1258921
- SUSE Bug 1258923
- SUSE Bug 1258924
- SUSE Bug 1258939
- SUSE Bug 1258941
- SUSE Bug 1258967
- SUSE Bug 1258973
- SUSE Bug 1258976
- SUSE Bug 1258977
- SUSE Bug 1258987
- SUSE Bug 1259680
- SUSE Bug 1259684
- SUSE Bug 1259689
- SUSE Bug 1259692
- SUSE Bug 1259693
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-25941
- SUSE Bug 1258919
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0-6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25942
- SUSE Bug 1258920
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25952
- SUSE Bug 1258921
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25953
- SUSE Bug 1258923
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25954
- SUSE Bug 1258924
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` frees `surface->data` without invalidating the `appWindow->image` that aliases it. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25955
- SUSE Bug 1258973
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls `xf_cliprdr_clear_cached_data` -> `HashTable_Clear` which frees the same data via `xf_cached_data_free`, triggering a heap use after free. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25959
- SUSE Bug 1258976
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25997
- SUSE Bug 1258977
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
Затронутые продукты
Ссылки
- CVE-2026-26986
- SUSE Bug 1258967
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a reachable `WINPR_ASSERT` -> `abort()`. The crash occurs in upstream builds where `WITH_VERBOSE_WINPR_ASSERT=ON` (default in FreeRDP 3.22.0 / current WinPR CMake defaults). Smartcard redirection must be explicitly enabled by the user (e.g., `xfreerdp /smartcard`; `/smartcard-logon` implies `/smartcard`). Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-27015
- SUSE Bug 1258987
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
Затронутые продукты
Ссылки
- CVE-2026-27950
- SUSE Bug 1258941
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-27951
- SUSE Bug 1258939
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29774
- SUSE Bug 1259689
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29775
- SUSE Bug 1259684
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29776
- SUSE Bug 1259692
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31884
- SUSE Bug 1259680
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31897
- SUSE Bug 1259693