Bug 2442761 (CVE-2026-25941) - CVE-2026-25941 freerdp: FreeRDP: Information disclosure or client crash via out-of-bounds read in RDPGFX channel
Summary: CVE-2026-25941 freerdp: FreeRDP: Information disclosure or client crash via o...
Keywords:
Status: NEW
Alias: CVE-2026-25941
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2442811 2442816 2442819 2442839 2442846
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-02-25 21:04 UTC by OSIDB Bzimport
Modified: 2026-02-25 23:14 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-02-25 21:04:36 UTC 
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
Note You need to log in before you can comment on or make changes to this bug.