CVE-2026-26955

{"id": "CVE-2026-26955", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-02-25T21:16:42.863", "references": [{"url": "https://github.com/FreeRDP/FreeRDP/commit/7d8fdce2d0ef337cb86cb37fc0c436c905e04d77", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command \u2014 full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch."}, {"lang": "es", "value": "FreeRDP es una implementaci\u00f3n gratuita del Protocolo de Escritorio Remoto. Antes de la versi\u00f3n 3.23.0, un servidor RDP malicioso puede desencadenar un desbordamiento de b\u00fafer de mont\u00f3n en clientes FreeRDP que utilizan la tuber\u00eda de superficie GDI (por ejemplo, 'xfreerdp') enviando un comando de superficie RDPGFX ClearCodec con un rect\u00e1ngulo de destino fuera de l\u00edmites. El gestor 'gdi_SurfaceCommand_ClearCodec()' no llama a 'is_within_surface()' para validar el rect\u00e1ngulo del comando contra las dimensiones de la superficie de destino, permitiendo que 'cmd->left'/'cmd->top' (y los desplazamientos del rect\u00e1ngulo del subc\u00f3dec) controlados por el atacante alcancen rutinas de copia de imagen que escriben en 'surface->data' sin aplicaci\u00f3n de l\u00edmites. La escritura OOB corrompe el puntero 'codecs*' de una estructura 'gdiGfxSurface' adyacente con datos de p\u00edxeles controlados por el atacante, y la corrupci\u00f3n de 'codecs*' es suficiente para alcanzar una llamada a puntero de funci\u00f3n indirecta ('NSC_CONTEXT.decode' en 'nsc.c:500') en un comando de c\u00f3dec subsiguiente \u2014 control total del puntero de instrucci\u00f3n (RIP) demostrado en el arn\u00e9s de explotabilidad. Los usuarios deben actualizar a la versi\u00f3n 3.23.0 para recibir un parche."}], "lastModified": "2026-02-27T14:50:07.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31715854-6D23-4207-AB69-27707C7B2D42", "versionEndExcluding": "3.23.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}