FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…reeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw Üretici bülteni
• vulncheck.com/…2.2-proxy-memory-exhaustion-via-dvc-reassembly Üçüncü taraf

Kayıt geçmişi

1. 3 Kas 2026 17:28Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-121410FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2
• 3,1 CVE-2026-121411FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry
• 5,9 CVE-2026-121409FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
• 6,5 CVE-2026-121407FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
• 5,3 CVE-2026-121408FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
• 4,3 CVE-2026-121406FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload