CVE-2026-67298

A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol (RDP) packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the FreeRDP server, leading to a denial of service.

This is an Important flaw. A heap buffer overflow in the FreeRDP server-side RAIL channel handler can be exploited by a malicious or compromised RDP client, leading to a denial of service. This vulnerability impacts the availability of remote desktop services on Red Hat systems by causing the RDP server to crash. Exploitation requires the RDP server to be active and reachable by an attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue do not expose FreeRDP server/proxy/shadow (freerdp-shadow-cli / freerdp-proxy) to untrusted networks—allow only trusted clients via firewall, or disable those services if unused.