Technical impact
FreeRDP before 3.26.0 contains a heap‑buffer‑overflow (CWE‑122) and out‑of‑bounds write (CWE‑787) vulnerability in the gdi_CacheToSurface function that allows remote attackers to write out‑of‑bounds heap memory. The bug arises because rectangle validation clamps coordinates to UINT16_MAX while copy operations use unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out‑of‑bounds writes that can lead to remote code execution or client crashes.
Affected Systems
The affected product is FreeRDP, all installations of which are vulnerable when their version is older than 3.26.0. Users running FreeRDP clients that connect to Remote Desktop Protocol servers on their networks may be impacted.
Risk and Exploitability
The CVSS score of 8.6 indicates a high severity vulnerability, and the EPSS score of 1% indicates a very low but non-zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker controlling an RDP server that sends specially crafted rectangle parameters to a FreeRDP client; the attack can be performed remotely over the network if the client is reachable. Given the potential for remote code execution, the risk is significant and the vulnerability should be addressed promptly.
Ubuntu USN