PT-2026-25335 · Freerdp+1 · Freerdp+1
Wooseokdotkim
·
Publicado
2026-01-01
·
Atualizado
2026-04-25
·
CVE-2026-31806
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.24.0
Description
FreeRDP is an implementation of the Remote Desktop Protocol. The
gdi surface bits() function handles SURFACE BITS COMMAND messages from the RDP server. When using NSCodec, the bmp.width and bmp.height values are not validated against desktop dimensions. A malicious RDP server can send crafted bmp.width and bmp.height values exceeding the expected surface size. This can lead to a heap buffer overflow because these values are used during bitmap decoding and memory operations without proper bounds checking. An attacker controlling the pixel data can potentially overwrite adjacent heap memory.Recommendations
Versions prior to 3.24.0 should be updated to version 3.24.0 or later.
Exploit
Correção
DoS
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freerdp
Rocky Linux