PT-2026-115381 · Freerdp · Freerdp
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions 3.0.0 through 3.31.0
Description
The Windows RAIL client contains an out-of-bounds read issue where malicious RDP servers can trigger heap over-reads by sending window titles that are not NUL-terminated. This occurs when a full-length WINDOW ORDER FIELD TITLE update is processed by the
wf rail window common() function and passed to SetWindowTextW(), which can lead to corrupted titles or client crashes.Recommendations
Update FreeRDP to version 3.32.0.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freerdp