CVE-2026-67298

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description A heap buffer overflow exists in the server-side RAIL channel handler. The issue occurs within the rail server handle messages() function in channels/rail/server/rail main.c when processing a RAIL PDU header. The software subtracts RAIL PDU HEADER LENGTH from the peer-controlled orderLength field without verifying that orderLength is at least the header length. If orderLength is between 0 and 3, an unsigned integer underflow occurs, resulting in a very large size that bypasses the Stream EnsureRemainingCapacity() capacity check via pointer arithmetic wraparound. This value is then passed to WTSVirtualChannelRead(), leading to an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server.

Recommendations Update to version 3.29.0.