Summary
[2:2.11.7-7.3]
- Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952)
Resolves: RHEL-159860
[2:2.11.7-7.2]
- Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
- Fix growth of preallocated buffers (CVE-2026-27951)
- Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
- Add DSP format checks (CVE-2026-31884)
- Fix DSP array bounds checks (CVE-2026-31883)
- Fix DSP array bounds checks (CVE-2026-31885)
- Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
Resolves: RHEL-159816, RHEL-155478, RHEL-161047, RHEL-161482
Resolves: RHEL-161519, RHEL-161085, RHEL-168463
[2:2.11.7-7.1]
- Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
- Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
Resolves: RHEL-163097, RHEL-163113
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | freerdp | 2:2.11.7-7.el9_8.3 |
| Oracle Linux · 9 | freerdp-devel | 2:2.11.7-7.el9_8.3 |
| Oracle Linux · 9 | freerdp-libs | 2:2.11.7-7.el9_8.3 |
| Oracle Linux · 9 | libwinpr | 2:2.11.7-7.el9_8.3 |
| Oracle Linux · 9 | libwinpr-devel | 2:2.11.7-7.el9_8.3 |
Vulnerabilities 2
-
High 7.5
FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is in…
-
Medium 6.5
FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is …