{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67298 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2026-67298 is a high-severity vulnerability in FreeRDP, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-67298 and fix it if it is affected.\n\nWhat it is: CVE-2026-67298 is a high-severity vulnerability in FreeRDP, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67298 exists.\n\nAffected product: FreeRDP. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-67298/ (Markdown: https://insights.sbomify.com/CVE-2026-67298/index.md)","id":"CVE-2026-67298","markdown":"https://insights.sbomify.com/CVE-2026-67298/index.md","name":"CVE-2026-67298","record":{"aliases":["DEBIAN-CVE-2026-67298","GHSA-wrfm-6x9r-42cr","UBUNTU-CVE-2026-67298"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"RDP server software","requires_auth":"none","summary":"A malicious RDP client can trigger a heap buffer overflow in FreeRDP server via integer underflow, causing crashes or potential code execution.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-191","name":"Integer Underflow (Wrap or Wraparound)"}],"description":"FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow","id":"CVE-2026-67298","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message","id":"CVE-2026-67299"},"packages":[],"prev":{"headline":"FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response","id":"CVE-2026-67297"},"products":["FreeRDP"],"published":"2026-08-01","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-03","vendors":["FreeRDP"]},"summary":"A malicious RDP client can trigger a heap buffer overflow in FreeRDP server via integer underflow, causing crashes or potential code execution.","url":"https://insights.sbomify.com/CVE-2026-67298/"}