CVE-2026-63117

Katalog CVE

CVSS 6.5 · Medium EPSS 0,55%

Kerentanan Divide By Zero pada freerdp. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-369: Divide By Zero

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v64m-xxfw-hrv6 advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/b78fc0b138fe8f08a8b102e193ffb32986f4449a patch
• https://github.com/FreeRDP/FreeRDP/pull/12980 issue tracking · patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 release notes