Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114047: FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data. CVE-2026-114046: FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process. CVE-2026-114045: FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution. CVE-2026-114043: FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | freerdp | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-debuginfo | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-debugsource | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-devel | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-libs | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-libs-debuginfo | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-server | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | freerdp-server-debuginfo | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | libwinpr | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | libwinpr-debuginfo | 2:3.32.2-1.amzn2023 |
| Amazon Linux · 2023 | libwinpr-devel | 2:3.32.2-1.amzn2023 |
Vulnerabilities 4
-
High 8.8
FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FOR…
-
Medium 6.8
FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound c…
-
Medium 6.5
Vulnerability in FreeRDP
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assum…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing…