CVE-2026-44420

Katalog CVE

CVSS 8.8 · High EPSS 0,86%

Kerentanan Heap-based Buffer Overflow pada freerdp. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

27 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvpx-xj7r-3p3r exploit · mitigasi · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:36203
• https://access.redhat.com/errata/RHSA-2026:46393
• https://access.redhat.com/security/cve/CVE-2026-44420
• https://bugzilla.redhat.com/show_bug.cgi?id=2483480
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44420.json