CVE-2025-4478

Katalog CVE

CVSS 6.5 · Medium EPSS 0,54%

Kerentanan NULL Pointer Dereference pada freerdp, redhat enterprise linux. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.

Rincian

Terbit di NVD

16 Mei 2025

Terakhir diubah

30 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2025:9307 advisory vendor
• https://access.redhat.com/security/cve/CVE-2025-4478 advisory vendor
• https://github.com/FreeRDP/FreeRDP/pull/11573 patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2365232 issue tracking · permissions required