Bug 2565938 (CVE-2026-121403)
| Summary: | CVE-2026-121403 freerdp: FreeRDP: Denial of Service via malformed drive redirection request | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending a malformed drive redirection request with truncated data to a connected client. This request causes the client's drive background worker to exit unexpectedly while leaving the communication channel active. Consequently, subsequent incoming requests accumulate unbounded in memory, exhausting system resources and disrupting the active remote desktop session.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2566783, 2566784 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-11-03 16:37:04 UTC
|