Описание
Security update for freerdp
This update for freerdp fixes the following issues:
- CVE-2026-27951: 32-bit system denial of service via endless blocking loop in
Stream_EnsureCapacity(bsc#1258939). - CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).
- CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).
- CVE-2026-33982: heap buffer overread in
winpr_aligned_offset_recalloc()can lead to undefined behavior (bsc#1261222). - CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80 billion iteration loop (bsc#1261200).
- CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).
- CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).
- CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
- CVE-2026-33987: heap out-of-bounds write due to persistent cache
bmpSizedesync (bsc#1261226). - CVE-2026-33995: double-free in
kerberos_AcceptSecurityContext()andkerberos_InitializeSecurityContextA()can lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227). - CVE-2026-40033: heap buffer overflow in
gdi_CacheToSurfaceallows attackers to cause a denial of service or achieve remote code execution (bsc#1266317). - CVE-2026-40254: off-by-one error in
contains_dotdot()allows for drive channel path traversal (bsc#1262743). - CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends
a
CB_CLIP_CAPSPDU with a too-smallcapabilitySetLength(bsc#1267008). - CVE-2026-44421: improper validation in
gdi_CacheToSurfacecan lead to a heap buffer overwrite client when an RDP server sends crafted RDPGFX PDUs (bsc#1267009). - CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR authentication-redirection path (bsc#1267010).
- CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write (bsc#1267011).
- CVE-2026-56297: improper synchronization of
channel_callbackaccess can lead to use-after-free indvcman_channel_closeanddvcman_call_on_receivetriggered by a malicious RDP server (bsc#1271071). - CVE-2026-57156: integer overflow in
update_read_delta_pointsallows malicious RDP peers to cause a heap buffer overflow (bsc#1271303). - CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM
DeviceNameandVirtualChannelNamefields (bsc#1271304). - CVE-2026-57158: incomplete fix for CVE-2026-23530 in
planar_decompress_plane_rle_onlyallows a malicious RDP server to trigger a one byte buffer overflow via a truncatedRDPGFX_CMDID_WIRETOSURFACE_1planar payload (bsc#1271305).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Workstation Extension 15 SP7
Ссылки
- Link for SUSE-SU-2026:3562-1
- E-Mail link for SUSE-SU-2026:3562-1
- SUSE Security Ratings
- SUSE Bug 1258939
- SUSE Bug 1261196
- SUSE Bug 1261198
- SUSE Bug 1261200
- SUSE Bug 1261211
- SUSE Bug 1261217
- SUSE Bug 1261222
- SUSE Bug 1261223
- SUSE Bug 1261226
- SUSE Bug 1261227
- SUSE Bug 1262743
- SUSE Bug 1266317
- SUSE Bug 1267008
- SUSE Bug 1267009
- SUSE Bug 1267010
- SUSE Bug 1267011
- SUSE Bug 1271071
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-27951
- SUSE Bug 1258939
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecting all FreeRDP clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds (WITH_VERBOSE_WINPR_ASSERT=ON). This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33952
- SUSE Bug 1261196
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33977
- SUSE Bug 1261198
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33982
- SUSE Bug 1261222
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33983
- SUSE Bug 1261200
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33984
- SUSE Bug 1261211
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33985
- SUSE Bug 1261217
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33986
- SUSE Bug 1261223
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData points to the old buffer. This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33987
- SUSE Bug 1261226
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP clients on systems where Kerberos and/or Kerberos U2U is configured (Samba AD member, or krb5 for NFS). The crash is triggered during NLA connection teardown and requires a failed authentication attempt. This issue has been patched in version 3.24.2.
Затронутые продукты
Ссылки
- CVE-2026-33995
- SUSE Bug 1261227
Описание
FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.
Затронутые продукты
Ссылки
- CVE-2026-40033
- SUSE Bug 1266317
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue.
Затронутые продукты
Ссылки
- CVE-2026-40254
- SUSE Bug 1262743
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.
Затронутые продукты
Ссылки
- CVE-2026-44420
- SUSE Bug 1267008
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.
Затронутые продукты
Ссылки
- CVE-2026-44421
- SUSE Bug 1267009
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
Затронутые продукты
Ссылки
- CVE-2026-44422
- SUSE Bug 1267010
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.
Затронутые продукты
Ссылки
- CVE-2026-45700
- SUSE Bug 1267011
Описание
FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.
Затронутые продукты
Ссылки
- CVE-2026-56297
- SUSE Bug 1271071
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.
Затронутые продукты
Ссылки
- CVE-2026-57156
- SUSE Bug 1271303
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound, allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in version 3.28.0.
Затронутые продукты
Ссылки
- CVE-2026-57157
- SUSE Bug 1271304
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.
Затронутые продукты
Ссылки
- CVE-2026-57158
- SUSE Bug 1271305