Vulnerabilidad · Publicado 01/08/2026 · Actualizado 02/08/2026
FreeRDP versiones 3.28.0 e inferiores contienen un desbordamiento de heap en el manejador del canal RAIL del lado del servidor. Un atacante remoto puede explotar esta vulnerabilidad mediante un mensaje RAIL malformado enviado a servidores RDP expuestos, causando corrupción de memoria y potencial ejecución de código arbitrario. El impacto es alta en infraestructuras de acceso remoto comunes en empresas latinoamericanas que utilizan FreeRDP como servidor de escritorio remoto.
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-191
Publicado en NIST NVD.