GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OESA-2026-2439 (CVE-2026-25942)

Vulnerability from osv_openeuler – Published: 2026-05-22 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
freerdp security update
Details

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp.

Security Fix(es):

A malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the xf_SetWindowMinMaxInfo function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window within xf_rail_server_min_max_info returns an unprotected pointer from the railWindows hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_AppUpdateWindowFromSurface function reads from a freed xfAppWindow object. This occurs because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the xf_rail_server_local_move_size function dereferences a freed xfAppWindow pointer. This occurs because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function Stream_EnsureCapacity contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to SIZE_MAX.(CVE-2026-27951)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.(CVE-2026-29774)

FreeRDP contains a heap buffer overflow vulnerability in bitmap_cache_put function where an out-of-bounds cacheId can lead to memory corruption.(CVE-2026-29775)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.(CVE-2026-31884)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.(CVE-2026-31897)

A vulnerability exists in FreeRDP when processing the ClearCodec protocol, involving a desynchronization in glyph cache counts. An attacker can craft a malicious RDP packet, causing a mismatch in glyph cache counts on the client or server side, which triggers a heap out-of-bounds read. Successful exploitation of this vulnerability could lead to information disclosure, application crash, or create conditions for further attacks.(CVE-2026-33985)

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "freerdp-2.11.8-5.oe2403sp3.aarch64.rpm",
          "freerdp-debuginfo-2.11.8-5.oe2403sp3.aarch64.rpm",
          "freerdp-debugsource-2.11.8-5.oe2403sp3.aarch64.rpm",
          "freerdp-devel-2.11.8-5.oe2403sp3.aarch64.rpm",
          "freerdp-help-2.11.8-5.oe2403sp3.aarch64.rpm",
          "libwinpr-2.11.8-5.oe2403sp3.aarch64.rpm",
          "libwinpr-devel-2.11.8-5.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "freerdp-2.11.8-5.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "freerdp-2.11.8-5.oe2403sp3.x86_64.rpm",
          "freerdp-debuginfo-2.11.8-5.oe2403sp3.x86_64.rpm",
          "freerdp-debugsource-2.11.8-5.oe2403sp3.x86_64.rpm",
          "freerdp-devel-2.11.8-5.oe2403sp3.x86_64.rpm",
          "freerdp-help-2.11.8-5.oe2403sp3.x86_64.rpm",
          "libwinpr-2.11.8-5.oe2403sp3.x86_64.rpm",
          "libwinpr-devel-2.11.8-5.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "freerdp",
        "purl": "pkg:rpm/openEuler/freerdp\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.8-5.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft\u0026amp;apos;s open specifications. This package provides the client applications xfreerdp.\r\n\r\nSecurity Fix(es):\n\nA malicious server can trigger a client-side global buffer overflow, causing a crash (denial of service)(CVE-2026-25942)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a heap-use-after-free vulnerability exists in the X11 client backend. Specifically, the `xf_SetWindowMinMaxInfo` function dereferences a freed `xfAppWindow` pointer. This occurs because `xf_rail_get_window` within `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table. The main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer, leading to a dangling pointer. A malicious server can exploit this to trigger a client-side crash (Denial of Service) and potentially cause heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25952)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the `xf_AppUpdateWindowFromSurface` function reads from a freed `xfAppWindow` object. This occurs because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order, resulting in a use-after-free condition. A malicious server can exploit this vulnerability to trigger a client-side heap use-after-free, causing a crash (Denial of Service) and potentially leading to heap corruption with a risk of code execution, depending on allocator behavior and surrounding heap layout.(CVE-2026-25953)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the `xf_rail_server_local_move_size` function dereferences a freed `xfAppWindow` pointer. This occurs because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. A malicious server can trigger this client-side heap use-after-free, causing a crash (Denial of Service) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.(CVE-2026-25954)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` contains an integer overflow vulnerability that can create an endless blocking loop. This may affect all client and server implementations using FreeRDP. For practical exploitation, this will only work on 32-bit systems where the available physical memory is greater than or equal to `SIZE_MAX`.(CVE-2026-27951)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client\u0026apos;s AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates.  In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect-\u0026gt;left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect-\u0026gt;top * nDstStep + rect-\u0026gt;left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.(CVE-2026-29774)\n\nFreeRDP contains a heap buffer overflow vulnerability in bitmap_cache_put function where an out-of-bounds cacheId can lead to memory corruption.(CVE-2026-29775)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context-\u0026gt;common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.(CVE-2026-31884)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize \u0026gt;= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.(CVE-2026-31897)\n\nA vulnerability exists in FreeRDP when processing the ClearCodec protocol, involving a desynchronization in glyph cache counts. An attacker can craft a malicious RDP packet, causing a mismatch in glyph cache counts on the client or server side, which triggers a heap out-of-bounds read. Successful exploitation of this vulnerability could lead to information disclosure, application crash, or create conditions for further attacks.(CVE-2026-33985)",
  "id": "OESA-2026-2439",
  "modified": "2026-08-06T11:11:23Z",
  "published": "2026-05-22T11:11:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2439"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25942"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25952"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25953"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25954"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27951"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29774"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29775"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31884"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31897"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33985"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "freerdp security update",
  "upstream": [
    "CVE-2026-25942",
    "CVE-2026-25952",
    "CVE-2026-25953",
    "CVE-2026-25954",
    "CVE-2026-27951",
    "CVE-2026-29774",
    "CVE-2026-29775",
    "CVE-2026-31884",
    "CVE-2026-31897",
    "CVE-2026-33985"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.