CVE-2026-67298 Details
Description
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.
A heap buffer overflow vulnerability has been identified in FreeRDP versions through 3.28.0. The issue resides in the server-side RAIL channel handler, specifically within the function rail_server_handle_messages(). The vulnerability is triggered when the handler processes a RAIL PDU header. The code improperly subtracts the fixed header length from the peer-controlled orderLength field without first validating that orderLength is sufficiently large. This oversight allows for an unsigned integer underflow, where orderLength values between 0 and 3 are manipulated to a large size. Consequently, the Stream_EnsureRemainingCapacity() check, which is meant to prevent buffer overflows, is bypassed. The underflowed size is then passed to WTSVirtualChannelRead(), leading to an out-of-bounds write on the heap. A malicious or compromised RDP client can exploit this vulnerability to corrupt memory, causing the server to crash.
Users can upgrade to FreeRDP version 3.29.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |