Description
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.
Published: 2026-08-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FreeRDP server‑side code handling the RAIL channel does not validate the orderLength field supplied by a client. The handler subtracts the RAIL PDU header length from this peer‑controlled value without first confirming that the value is at least that large. When an orderLength of 0 to 3 is used, the subtraction underflows an unsigned integer, producing an astronomically large length that bypasses the stream’s capacity check and is then used to write beyond the end of a heap buffer during a channel read. The resulting heap corruption causes the server to crash but does not provide a direct path to arbitrary code execution, leaving the primary impact as a denial of service by crashing the FreeRDP daemon or RDP server process.

Affected Systems

FreeRDP, server‑side RAIL channel handler versions 3.28.0 and earlier are affected. The vulnerability applies to all deployments that use the RAIL channel in these releases of FreeRDP.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from a remote RDP client that can establish a valid RDP session and send a crafted RAIL PDU. No privileged escalation is required; the issue is triggered by the client during normal channel operation, making it a straightforward attack path for any remote RDP participant.

Generated by OpenCVE AI on August 3, 2026 at 09:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.29.0 or newer, which removes the heap buffer overflow.
  • Disable the RAIL channel plugin in the server configuration if the channel is not required, eliminating the attack surface.
  • Restrict inbound RDP connections to trusted IP addresses and apply network segmentation to reduce exposure to malicious clients.

Generated by OpenCVE AI on August 3, 2026 at 09:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 01 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.
Title FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-191
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-03T19:50:59.750Z

Reserved: 2026-07-29T13:04:41.947Z

Link: CVE-2026-67298

cve-icon Vulnrichment

Updated: 2026-08-03T19:50:43.854Z

cve-icon NVD

Status : Received

Published: 2026-08-01T13:16:59.107

Modified: 2026-08-03T20:17:26.477

Link: CVE-2026-67298

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-01T12:22:18Z

Links: CVE-2026-67298 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T09:45:04Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)