Описание
Security update for freerdp
This update for freerdp fixes the following issues:
- CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted
WIRE_TO_SURFACE_2PDU (bsc#1258919). - CVE-2026-25942: Global-buffer-overflow in
xf_rail_server_execute_result(bsc#1258920). - CVE-2026-25952: Heap-use-after-free in
xf_SetWindowMinMaxInfo(bsc#1258921). - CVE-2026-25953: Heap-use-after-free in
xf_AppUpdateWindowFromSurface(bsc#1258923). - CVE-2026-25954: Heap-use-after-free in
xf_rail_server_local_move_size(bsc#1258924). - CVE-2026-25997: Heap-use-after-free in
xf_clipboard_format_equal(bsc#1258977). - CVE-2026-26986: Heap-use-after-free in
rail_window_free(bsc#1258967). - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable
WINPR_ASSERTabort (bsc#1258987). - CVE-2026-27951: Denial of service via endless blocking loop in
Stream_EnsureCapacity(bsc#1258939). - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
- CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
- CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
- CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
Ссылки
- Link for SUSE-SU-2026:1634-1
- E-Mail link for SUSE-SU-2026:1634-1
- SUSE Security Ratings
- SUSE Bug 1258919
- SUSE Bug 1258920
- SUSE Bug 1258921
- SUSE Bug 1258923
- SUSE Bug 1258924
- SUSE Bug 1258939
- SUSE Bug 1258967
- SUSE Bug 1258977
- SUSE Bug 1258987
- SUSE Bug 1259680
- SUSE Bug 1259684
- SUSE Bug 1259689
- SUSE Bug 1259692
- SUSE Bug 1259693
- SUSE Bug 1261848
- SUSE CVE CVE-2026-25941 page
- SUSE CVE CVE-2026-25942 page
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-25941
- SUSE Bug 1258919
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0-6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25942
- SUSE Bug 1258920
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25952
- SUSE Bug 1258921
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25953
- SUSE Bug 1258923
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25954
- SUSE Bug 1258924
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25997
- SUSE Bug 1258977
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
Затронутые продукты
Ссылки
- CVE-2026-26986
- SUSE Bug 1258967
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a reachable `WINPR_ASSERT` -> `abort()`. The crash occurs in upstream builds where `WITH_VERBOSE_WINPR_ASSERT=ON` (default in FreeRDP 3.22.0 / current WinPR CMake defaults). Smartcard redirection must be explicitly enabled by the user (e.g., `xfreerdp /smartcard`; `/smartcard-logon` implies `/smartcard`). Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-27015
- SUSE Bug 1258987
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-27951
- SUSE Bug 1258939
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29774
- SUSE Bug 1259689
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29775
- SUSE Bug 1259684
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29776
- SUSE Bug 1259692
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31884
- SUSE Bug 1259680
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31897
- SUSE Bug 1259693