FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…reeRDP/security/advisories/GHSA-3hf9-w6hr-hf9j Üretici bülteni
• vulncheck.com/…l-of-service-via-oversized-x-224-routing-token Üçüncü taraf

Kayıt geçmişi

1. 3 Kas 2026 17:28Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-121412FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
• 4,3 CVE-2026-121410FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2
• 3,1 CVE-2026-121411FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry
• 6,5 CVE-2026-121407FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
• 5,3 CVE-2026-121408FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
• 4,3 CVE-2026-121406FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload