PT-2026-34838 · Freerdp+1 · Freerdp+1

Medoedus · CVE-2026-40254 · Published 2026-04-23 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.25.0

Description An off-by-one error exists in the path traversal filter within channels/drive/client/drive file.c. The contains dotdot() function fails to detect .. when it is the final component of a path without a trailing separator, although it correctly identifies ../ and .. mid-path. A malicious RDP server can exploit this to read, list, or write files one directory above the client's shared folder via RDPDR requests, provided the client connects with drive redirection enabled.

Recommendations Update to version 3.25.0.

Exploit

Fix

DoS

Weakness Enumeration

CWE-193

Related Identifiers

BDU:2026-09693

CVE-2026-40254

GHSA-3XPJ-M4HX-8VMX

OPENSUSE-SU-2026:10832-1

OPENSUSE-SU-2026:21116-1

SUSE-SU-2026:22194-1

USN-8561-1

Affected Products

Freerdp

Red Os

References · 75

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40254.json · Exploit
• https://ubuntu.com/security/CVE-2026-33985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44420 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29775 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40254 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8561-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40254 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-55564 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-55827 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21116-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-57158 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22194-1 · Vendor Advisory