Bug 2550526 (CVE-2026-109947)
| Summary: | CVE-2026-109947 freerdp: FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FreeRDP. When a user connects to a malicious or compromised Remote Desktop Protocol (RDP) server with drive redirection enabled, the server can issue an oversized read request. Because incoming read request sizes are not properly bounded, the client attempts to allocate an excessively large memory buffer, leading to memory exhaustion and an application crash. This failure results in a Denial of Service (DoS) for the connecting user.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2562600 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-13 13:55:12 UTC
|