PT-2026-25332 · Freerdp+1 · Freerdp+1
Ehdgks0627
·
Publicado
2026-01-01
·
Atualizado
2026-06-15
·
CVE-2026-29774
CVSS v3.1
8.2
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.24.0
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. A client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. The issue stems from unchecked pointer arithmetic when computing destination pointers using
rect->left, potentially allowing writes beyond the allocated heap region. A malicious server can trigger this by sending a WIRE TO SURFACE PDU 1 with an AVC420 codec containing a regionRects entry where left exceeds the surface width. The vulnerable code is located in yuv.c within the clamp() function (line 347) and the avc420 yuv to rgb function (line 67). The clamp() function only validates top/bottom against the surface height, but does not check left/right against the surface width.Recommendations
Update FreeRDP to version 3.24.0 or later.
Exploit
Correção
DoS
Memory Corruption
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freerdp
Red Os