CVE-2026-63633

Katalog CVE

CVSS 9.8 · Critical EPSS 0,62%

Kerentanan Heap-based Buffer Overflow pada freerdp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xq exploit · mitigasi · advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae patch
• https://github.com/FreeRDP/FreeRDP/pull/12993 issue tracking · patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 release notes