Описание
Security update for freerdp2
This update for freerdp2 fixes the following issues:
- CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted
WIRE_TO_SURFACE_2PDU (bsc#1258919). - CVE-2026-25942: Global-buffer-overflow in
xf_rail_server_execute_result(bsc#1258920). - CVE-2026-25952: Heap-use-after-free in
xf_SetWindowMinMaxInfo(bsc#1258921). - CVE-2026-25953: Heap-use-after-free in
xf_AppUpdateWindowFromSurface(bsc#1258923). - CVE-2026-25954: Heap-use-after-free in
xf_rail_server_local_move_size(bsc#1258924). - CVE-2026-25997: Heap-use-after-free in
xf_clipboard_format_equal(bsc#1258977). - CVE-2026-26986: Heap-use-after-free in
rail_window_free(bsc#1258967). - CVE-2026-27015: Smartcard NDR alignment padding triggers reachable
WINPR_ASSERTabort (bsc#1258987). - CVE-2026-27951: Denial of Service via endless blocking loop in
Stream_EnsureCapacity(bsc#1258939). - CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
- CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
- CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
- CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Workstation Extension 15 SP7
Ссылки
- Link for SUSE-SU-2026:1640-1
- E-Mail link for SUSE-SU-2026:1640-1
- SUSE Security Ratings
- SUSE Bug 1258919
- SUSE Bug 1258920
- SUSE Bug 1258921
- SUSE Bug 1258923
- SUSE Bug 1258924
- SUSE Bug 1258939
- SUSE Bug 1258967
- SUSE Bug 1258977
- SUSE Bug 1258987
- SUSE Bug 1259653
- SUSE Bug 1259680
- SUSE Bug 1259684
- SUSE Bug 1259689
- SUSE Bug 1259692
- SUSE Bug 1259693
- SUSE Bug 1261848
- SUSE CVE CVE-2026-25941 page
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-25941
- SUSE Bug 1258919
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0-6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25942
- SUSE Bug 1258920
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25952
- SUSE Bug 1258921
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25953
- SUSE Bug 1258923
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25954
- SUSE Bug 1258924
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25997
- SUSE Bug 1258977
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
Затронутые продукты
Ссылки
- CVE-2026-26986
- SUSE Bug 1258967
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a reachable `WINPR_ASSERT` -> `abort()`. The crash occurs in upstream builds where `WITH_VERBOSE_WINPR_ASSERT=ON` (default in FreeRDP 3.22.0 / current WinPR CMake defaults). Smartcard redirection must be explicitly enabled by the user (e.g., `xfreerdp /smartcard`; `/smartcard-logon` implies `/smartcard`). Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-27015
- SUSE Bug 1258987
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-27951
- SUSE Bug 1258939
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29774
- SUSE Bug 1259689
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29775
- SUSE Bug 1259684
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-29776
- SUSE Bug 1259692
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31806
- SUSE Bug 1259653
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31884
- SUSE Bug 1259680
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31897
- SUSE Bug 1259693