CVE-2025-4478 Gnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of service
A crafted RDP packet triggers a segmentation fault in FreeRDP during Anaconda's remote install, causing a denial of service requiring a reboot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4478?
CVE-2025-4478 is a medium-severity vulnerability in Freerdp Freerdp, published on 16 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
Weakness: CWE-476
Which versions are affected by CVE-2025-4478?
It affects 2 products.
Linux distribution packages (18)
freerdp AlmaLinux:10 | All versions | 2:3.10.3-3.el10_0 |
freerdp-devel AlmaLinux:10 | All versions | 2:3.10.3-3.el10_0 |
freerdp-libs AlmaLinux:10 | All versions | 2:3.10.3-3.el10_0 |
freerdp-server AlmaLinux:10 | All versions | 2:3.10.3-3.el10_0 |
libwinpr AlmaLinux:10 | All versions | 2:3.10.3-3.el10_0 |
libwinpr-devel AlmaLinux:10 | All versions | 2:3.10.3-3.el10_0 |
freerdp Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-debugsource Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-devel Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-libs Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-libs-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-server Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp-server-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
libwinpr Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
libwinpr-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
libwinpr-devel Red Hat:enterprise_linux:10.0 | All versions | 2:3.10.3-3.el10_0 |
freerdp Rocky Linux:10 | All versions | 2:3.10.3-3.el10_0 |
Products include Freerdp Freerdp, Redhat Enterprise Linux.
How do I fix CVE-2025-4478?
Apply the vendor's patch.
Is CVE-2025-4478 being exploited?
There is no known exploitation of CVE-2025-4478 in the wild and no public exploit code.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as ALSA-2025:9307, DEBIAN-CVE-2025-4478, GHSA-3p57-rq4q-233x, RHSA-2025:9307, RLSA-2025:9307, UBUNTU-CVE-2025-4478 and 1 more.