Bug 2550545 (CVE-2026-109679)
| Summary: | CVE-2026-109679 freerdp: FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FreeRDP. A malicious or compromised remote desktop gateway can cause a Denial of Service (DoS) by returning a response with an empty body during connection negotiation. When processing the response from an Azure Resource Manager (ARM) endpoint, the client fails to verify that the message body exists, resulting in a NULL pointer dereference. An attacker controlling the configured gateway can exploit this vulnerability to crash the connecting client application.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2562583 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-13 14:01:14 UTC
|