[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260210033724.GA31697@openwall.com>
Date: Tue, 10 Feb 2026 04:37:24 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: FreeRDP fixes 12 CVEs in 3.22.0 release
On Mon, Feb 09, 2026 at 03:31:46PM -0800, Alan Coopersmith wrote:
> > - @Keryer reported an issue affecting client and proxy:
> > CVE-2026-23948
> > - @ehdgks0627 did some more fuzzying and found quite a number of
> client
> > side bugs.
> > CVE-2026-24682
> > CVE-2026-24683
> > CVE-2026-24676
> > CVE-2026-24677
> > CVE-2026-24678
> > CVE-2026-24684
> > CVE-2026-24679
> > CVE-2026-24681
> > CVE-2026-24675
> > CVE-2026-24491
> > CVE-2026-24680
>
> More details on each of these are available at:
> - CVE-2026-24682 Heap-buffer-overflow in audio_formats_free
> https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcw2-pqgw-mx6g
> - CVE-2026-24677 Heap-buffer-overflow in ecam_encoder_compress_h264
> https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xw37-j744-f8v7
> - CVE-2026-24679 Heap-buffer-overflow in urb_select_interface
> https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x
All 3 of these "Heap-buffer-overflow" issues are actually out of bounds
reads, per ASan. It's another case of ASan mislabeling this, and people
blindly copying what it says into advisories and CVE titles.
It can't be ruled out (without code review) that if the out of bounds
reads did not terminate processing, some of them could possibly be
followed by out of bounds writes. However, ASan is currently unable to
find this.
I wonder if besides correcting the string "Heap-buffer-overflow" ASan
could reasonably be enhanced not to terminate the task on out of bounds
reads, so that it would also have a chance to detect subsequent writes.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
