Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2026-40033

Опубликовано: 26 мая 2026
Источник: ubuntu
Приоритет: medium
EPSS Низкий
CVSS3: 8.8

Описание

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

РелизСтатусПримечание
devel

DNE

esm-apps/bionic

needs-triage

esm-infra-legacy/xenial

needs-triage

jammy

DNE

noble

DNE

questing

DNE

resolute

DNE

upstream

needs-triage

Показывать по

РелизСтатусПримечание
devel

DNE

esm-apps/noble

needs-triage

esm-infra/bionic

needs-triage

esm-infra/focal

needs-triage

jammy

needs-triage

noble

needs-triage

questing

DNE

resolute

DNE

upstream

needs-triage

Показывать по

РелизСтатусПримечание
devel

not-affected

3.27.0+dfsg-1
jammy

DNE

noble

released

3.30.0+dfsg-0ubuntu0.24.04.1
questing

ignored

end of life, was needs-triage
resolute

released

3.30.0+dfsg-0ubuntu0.26.04.1
upstream

released

3.26.0

Показывать по

EPSS

Процентиль: 60%
0.01037
Низкий

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 8.8
redhat
2 месяца назад

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

CVSS3: 8.8
nvd
2 месяца назад

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

CVSS3: 8.8
debian
2 месяца назад

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in ...

CVSS3: 8.8
github
2 месяца назад

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

CVSS3: 8.8
fstec
3 месяца назад

Уязвимость функции gdi_CacheToSurface() RDP-клиента FreeRDP, позволяющая нарушителю выполнить произвольный код и вызвать отказ в обслуживании

EPSS

Процентиль: 60%
0.01037
Низкий

8.8 High

CVSS3