CVE-2026-67298

01/תיאור (מקור, אנגלית)

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.

02/מוצרים מושפעים

freerdp: freerdp

03/קישורים5

• github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmvw-52ph-‮… ExploitVendor Advisory
• github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-‮… Vendor Advisory
• github.com/FreeRDP/FreeRDP/commit/46848765f2a1134f8652f8760eef‮… Patch
• github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad‮… Patch
• www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-via-‮… Third Party Advisory