CVE-2026-55648

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Integer Overflow or Wraparound pada freerdp. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6 mitigasi · advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3 patch
• https://github.com/FreeRDP/FreeRDP/pull/12877 issue tracking · patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0 release notes