CVE-2026-55191
FreeRDP: FreeRDP: Arbitrary code execution via heap-buffer-overflow in AVC444 YUV buffer allocation
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), Amazon (élevée), Ubuntu (moyenne).
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.24 | freerdp | 3.27.1-r0 |
| alpine edge | freerdp | 3.27.1-r0 |
| amazon linux 2023 | freerdp, freerdp-debuginfo, freerdp-debugsource et 8 autres | 2:3.6.3-1.amzn2023.0.13 |
| debian 11 | freerdp2 | pas de correctif indiqué |
| debian 12 | freerdp2 | pas de correctif indiqué |
| debian 13 | freerdp3 | pas de correctif indiqué |
| debian 14 | freerdp3 | 3.27.0+dfsg-1 |
| echo | freerdp2, freerdp3 | pas de correctif indiqué |
| rapidfort alpine 3.20 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.21 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.22 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.23 | freerdp | 3.27.1-r0 |
Afficher les 46 entrées de 20 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.24 | freerdp | 3.27.1-r0 |
| alpine edge | freerdp | 3.27.1-r0 |
| amazon linux 2023 | freerdp | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-debugsource | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-devel | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-libs | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-libs-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-server | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-server-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | libwinpr | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | libwinpr-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | libwinpr-devel | 2:3.6.3-1.amzn2023.0.13 |
| debian 11 | freerdp2 | pas de correctif indiqué |
| debian 12 | freerdp2 | pas de correctif indiqué |
| debian 13 | freerdp3 | pas de correctif indiqué |
| debian 14 | freerdp3 | 3.27.0+dfsg-1 |
| echo | freerdp2 | pas de correctif indiqué |
| echo | freerdp3 | pas de correctif indiqué |
| rapidfort alpine 3.20 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.21 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.22 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.23 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.24 | freerdp | 3.27.1-r0 |
| rapidfort amazon linux 2023 | freerdp | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | freerdp-devel | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | freerdp-libs | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | freerdp-server | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | libwinpr | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | libwinpr-devel | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort debian 12 | freerdp2 | pas de correctif indiqué |
| rapidfort debian 12 | freerdp3 | 0:3.27.0+dfsg-1 |
| rapidfort debian 13 | freerdp2 | pas de correctif indiqué |
| rapidfort debian 13 | freerdp3 | 0:3.27.0+dfsg-1 |
| rapidfort fedora 43 | freerdp | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | freerdp-devel | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | freerdp-libs | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | freerdp-server | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | libwinpr | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | libwinpr-devel | 2:3.27.1-1.fc43 |
| Red Hat | freerdp | pas de correctif indiqué |
| Red Hat | freerdp-devel | pas de correctif indiqué |
| Red Hat | freerdp-libs | pas de correctif indiqué |
| Red Hat | freerdp-plugins | pas de correctif indiqué |
| ubuntu 24.04 | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 |
| ubuntu 26.04 | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 |
Références
- https://access.redhat.com/security/cve/CVE-2026-55191
- https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c
- https://github.com/FreeRDP/FreeRDP/pull/12873
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr
- https://nvd.nist.gov/vuln/detail/CVE-2026-55191
- https://ubuntu.com/security/notices/USN-8561-1
- https://www.cve.org/CVERecord?id=CVE-2026-55191