CVE-2026-67298: freerdp Integer Underflow (Wrap or Wraparound)

Vulnerability summary

CVE-2026-67298 is a high (CVSS 8.7) Integer Underflow (Wrap or Wraparound) vulnerability in freerdp. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.

• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.