Описание
Security update for freerdp2
This update for freerdp2 fixes the following issues:
Changes in freerdp2:
-
Update freerdp-3-macro:
- Add WINPR_ATTR_MALLOC macro from freerdp 3
-
Security fixes for the following issues:
- CVE-2026-25941: Fixed a out of bounds read (bsc#1258919)
- CVE-2026-25942: Fixed a buffer overflow in xf_rail_server_execute_result() (bsc#1258920)
- CVE-2026-27951: Fixed a denial of service in Stream_EnsureCapacity() (bsc#1258939)
- CVE-2026-25997: Fixed a use-after-free in xf_clipboard_format_equal() (bsc#1258977)
- CVE-2026-26986: Fixed a use-after-free in rail_window_free() (bsc#1258967)
- CVE-2026-27015: Fixed a client denial of service via reachable assert (bsc#1258987)
- CVE-2026-25952: Fixed a use-after-free in xf_SetWindowMinMaxInfo() (bsc#1258921)
- CVE-2026-25953: Fixed a use-after-free in xf_AppUpdateWindowFromSurface() (bsc#1258923)
- CVE-2026-25954: Fixed a use-after-free in xf_rail_server_local_move_size() (bsc#1258924)
- CVE-2026-24684: Fixed a use-after-free in play_thread() (bsc#1257991).
- CVE-2026-26271: Fixed a buffer overread in icon processing (bsc#1258979)
- CVE-2026-26955: Fixed a out of bounds write (bsc#1258982)
- CVE-2026-26965: Fixed a out of bounds write (bsc#1258985)
- CVE-2026-31806: Fixed a buffer overflow via improper validation of server messages (bsc#1259653)
- CVE-2026-31883: Fixed a buffer overflow via crafted audio format and wave data (bsc#1259679)
- CVE-2026-31885: Fixed a out of bounds read (bsc#1259686)
- CVE-2026-24491: Fix use-after-free that was accidentally introduced in the backport (bsc#1257981)
- CVE-2026-22855: Fixed a buffer overflow in smartcard_unpack_set_attrib_call() (bsc#1256721)
- CVE-2026-22857: Fixed a use-after-free in irp_thread_func() (bsc#1256723)
- CVE-2026-23533: Fixed a buffer overflow in clear_decompress_residual_data() (bsc#1256943)
- CVE-2026-23732: Fixed a buffer overflow in Glyph_Alloc() (bsc#1256945)
- CVE-2026-23883: Fixed a use-after-free (bsc#1256946)
- CVE-2026-23884: Fixed a use-after-free in gdi_set_bounds (bsc#1256947)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1256721
- SUSE Bug 1256723
- SUSE Bug 1256943
- SUSE Bug 1256945
- SUSE Bug 1256946
- SUSE Bug 1256947
- SUSE Bug 1257981
- SUSE Bug 1257991
- SUSE Bug 1258919
- SUSE Bug 1258920
- SUSE Bug 1258921
- SUSE Bug 1258923
- SUSE Bug 1258924
- SUSE Bug 1258939
- SUSE Bug 1258967
- SUSE Bug 1258977
- SUSE Bug 1258979
- SUSE Bug 1258982
- SUSE Bug 1258985
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
Затронутые продукты
Ссылки
- CVE-2026-22855
- SUSE Bug 1256721
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.
Затронутые продукты
Ссылки
- CVE-2026-22857
- SUSE Bug 1256723
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client-side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Затронутые продукты
Ссылки
- CVE-2026-23533
- SUSE Bug 1256943
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.
Затронутые продукты
Ссылки
- CVE-2026-23732
- SUSE Bug 1256945
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Затронутые продукты
Ссылки
- CVE-2026-23883
- SUSE Bug 1256946
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Затронутые продукты
Ссылки
- CVE-2026-23884
- SUSE Bug 1256947
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24491
- SUSE Bug 1257981
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24684
- SUSE Bug 1257991
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-25941
- SUSE Bug 1258919
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0-6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25942
- SUSE Bug 1258920
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25952
- SUSE Bug 1258921
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25953
- SUSE Bug 1258923
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25954
- SUSE Bug 1258924
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-25997
- SUSE Bug 1258977
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data. The bug is reachable over the network when a client processes icon data from an RDP server (or from a man-in-the-middle). Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-26271
- SUSE Bug 1258979
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command - full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.
Затронутые продукты
Ссылки
- CVE-2026-26955
- SUSE Bug 1258982
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128x128), an adjacent `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data - control-flow-relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.
Затронутые продукты
Ссылки
- CVE-2026-26965
- SUSE Bug 1258985
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
Затронутые продукты
Ссылки
- CVE-2026-26986
- SUSE Bug 1258967
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a reachable `WINPR_ASSERT` -> `abort()`. The crash occurs in upstream builds where `WITH_VERBOSE_WINPR_ASSERT=ON` (default in FreeRDP 3.22.0 / current WinPR CMake defaults). Smartcard redirection must be explicitly enabled by the user (e.g., `xfreerdp /smartcard`; `/smartcard-logon` implies `/smartcard`). Version 3.23.0 fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-27015
- SUSE Bug 1258987
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-27951
- SUSE Bug 1258939
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31806
- SUSE Bug 1259653
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31883
- SUSE Bug 1259679
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Затронутые продукты
Ссылки
- CVE-2026-31885
- SUSE Bug 1259686