PT-2026-67278 · Freerdp · Freerdp
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.29.0
Description
A heap buffer overflow exists in the server-side RAIL channel handler. The issue occurs within the
rail server handle messages() function in channels/rail/server/rail main.c when processing a RAIL PDU header. The software subtracts RAIL PDU HEADER LENGTH from the peer-controlled orderLength field without verifying that orderLength is at least the header length. If orderLength is between 0 and 3, an unsigned integer underflow occurs, resulting in a very large size that bypasses the Stream EnsureRemainingCapacity() capacity check via pointer arithmetic wraparound. This value is then passed to WTSVirtualChannelRead(), leading to an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server.Recommendations
Update to version 3.29.0.
Exploit
Fix
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freerdp