Bug 2567559 (CVE-2026-121962)

Summary: CVE-2026-121962 freerdp: freerdp: Denial of Service via heap buffer overflow during Early User Authorization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) or memory corruption by sending fragmented responses during Early User Authorization (EUA) authentication. Because FreeRDP fails to properly track remaining buffer space across partial network reads, incoming data advances past the allocated memory boundaries. An attacker who successfully exploits this issue triggers an out-of-bounds memory write, crashing the client application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2568298, 2568303    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-05 22:07:26 UTC 
FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service.