Bug 2565927 (CVE-2026-121406)
| Summary: | CVE-2026-121406 freerdp: freerdp: Denial of Service via zero-output graphics payload | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a specially crafted graphics payload that decompresses to zero bytes. Because the client fails to account for empty output data before initializing its internal stream buffer, an internal check fails, causing the client application to crash and terminate the active session.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2566785, 2566786 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-11-03 16:26:58 UTC
|