Bug 2443132 (CVE-2026-26955)

Summary:	CVE-2026-26955 freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit a heap buffer overflow vulnerability by sending a specially crafted graphics command to a FreeRDP client. This allows the server to write data outside of its intended memory region, potentially leading to arbitrary code execution on the client system. The vulnerability occurs because the client does not properly validate the dimensions of incoming graphics commands.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2443144, 2443146, 2443145
Bug Blocks:

Description OSIDB Bzimport 2026-02-26 21:04:09 UTC

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.

Comment 3 errata-xmlrpc 2026-03-26 11:34:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:5936 https://access.redhat.com/errata/RHSA-2026:5936

Comment 4 errata-xmlrpc 2026-03-26 12:16:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:5939 https://access.redhat.com/errata/RHSA-2026:5939

Comment 5 errata-xmlrpc 2026-03-30 01:40:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6005 https://access.redhat.com/errata/RHSA-2026:6005

Comment 6 errata-xmlrpc 2026-03-30 01:43:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:6004 https://access.redhat.com/errata/RHSA-2026:6004

Comment 7 errata-xmlrpc 2026-04-01 14:46:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:6384 https://access.redhat.com/errata/RHSA-2026:6384

Comment 8 errata-xmlrpc 2026-04-01 14:51:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:6385 https://access.redhat.com/errata/RHSA-2026:6385

Comment 9 errata-xmlrpc 2026-04-01 16:19:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:6395 https://access.redhat.com/errata/RHSA-2026:6395

Comment 10 errata-xmlrpc 2026-04-01 16:21:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:6396 https://access.redhat.com/errata/RHSA-2026:6396

Comment 11 errata-xmlrpc 2026-04-06 03:29:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:6616 https://access.redhat.com/errata/RHSA-2026:6616

Comment 12 errata-xmlrpc 2026-04-06 14:45:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:6665 https://access.redhat.com/errata/RHSA-2026:6665

Comment 13 errata-xmlrpc 2026-04-06 18:42:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:6712 https://access.redhat.com/errata/RHSA-2026:6712

Comment 14 errata-xmlrpc 2026-04-07 09:46:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:6764 https://access.redhat.com/errata/RHSA-2026:6764

Comment 15 errata-xmlrpc 2026-04-09 11:40:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:7292 https://access.redhat.com/errata/RHSA-2026:7292

Comment 17 errata-xmlrpc 2026-05-19 13:04:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19033 https://access.redhat.com/errata/RHSA-2026:19033