FreeRDP CVE-2026-67298

The target must be running FreeRDP in server mode (not client mode) with the RAIL virtual channel handler active, which requires RemoteApp or seamless window functionality to be enabled server-side. The CVSS 4.0 vector (PR:N/UI:N) indicates no authentication is required - the malformed RAIL PDU can be delivered during the virtual channel setup phase before credential validation completes. The attacker requires only network connectivity to the RDP listener port (default TCP 3389). Exploitation is limited to denial-of-service (process crash); the description does not confirm arbitrary code execution. Environments that use FreeRDP strictly as an RDP client and not as an RDP server are not affected by this vulnerability. Non-default RemoteApp/RAIL channel configuration is the key limiting factor - standard RDP-only deployments without RAIL enabled are not exposed to this code path.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) indicates a network-reachable, low-complexity, unauthenticated denial-of-service. Impact is strictly availability - heap corruption causes a server process crash but no confirmed confidentiality or integrity breach based on the description. This is consistent with a classic integer-underflow-driven DoS: real-world severity is significant for environments that depend on FreeRDP as an RDP server, but it does not represent a code-execution or data-exfiltration risk as described. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC has been identified, indicating opportunistic mass exploitation is not currently occurring. The primary real-world risk is targeted disruption of FreeRDP-based remote desktop infrastructure. Defenders should treat this as a high-priority patch given the zero-complexity, unauthenticated vector, even though the impact ceiling is DoS.

An attacker who can establish a TCP connection to a FreeRDP RDP server sends a RAIL virtual channel PDU with orderLength set to a value between 0 and 3 during the RAIL channel communication phase. The unchecked subtraction underflows to a near-maximum unsigned integer, which then bypasses the stream capacity guard and causes WTSVirtualChannelRead() to write far beyond the allocated heap buffer, corrupting adjacent heap metadata and crashing the server process. No public proof-of-concept exploit exists at time of analysis, but the vulnerability is mechanically straightforward to trigger given the predictable integer underflow behavior.