FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…reeRDP/security/advisories/GHSA-cx9c-q4jc-wm6c Üretici bülteni
• vulncheck.com/…se-after-free-via-dynamic-rdpsnd-channel-close Üçüncü taraf

Kayıt geçmişi

1. 4 Kas 2026 18:33Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-121964FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment
• 8,1 CVE-2026-121962FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read
• 5,9 CVE-2026-121961FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
• 6,5 CVE-2026-121959FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame
• 7,5 CVE-2026-121960FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest
• 8,8 CVE-2026-121958FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys