p PatchFirst

CVE-2025-4478

CVE-2025-4478 · Gnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 2:3.10.3-3.el10_0: Not affected (rpm)

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • freerdp3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.15.0+dfsg-2.1

    Update to 3.15.0+dfsg-2.1

  • freerdp3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.15.0+dfsg-2.1

    Update to 3.15.0+dfsg-2.1

  • freerdp3 Ubuntu:24.04:LTS

    Versions
    • 3.4.0+dfsg1-0ubuntu2
    • 3.4.0+dfsg1-0ubuntu3
    • 3.4.0+dfsg1-0ubuntu4
    • 3.5.0+dfsg1-0ubuntu1
    • 3.5.1+dfsg1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.5.1+dfsg1-0ubuntu1.1

    Update to 3.5.1+dfsg1-0ubuntu1.1

Original sources

Check your server →