Re: FreeRDP fixes 12 CVEs in 3.22.0 release

[Solar Designer <solar () openwall com>]

On Mon, Feb 09, 2026 at 03:31:46PM -0800, Alan Coopersmith wrote:
> >       - @Keryer reported an issue affecting client and proxy:
> >             CVE-2026-23948
> >       - @ehdgks0627 did some more fuzzying and found quite a number of 
> client
> >         side bugs.
> >             CVE-2026-24682
> >             CVE-2026-24683
> >             CVE-2026-24676
> >             CVE-2026-24677
> >             CVE-2026-24678
> >             CVE-2026-24684
> >             CVE-2026-24679
> >             CVE-2026-24681
> >             CVE-2026-24675
> >             CVE-2026-24491
> >             CVE-2026-24680
>
> More details on each of these are available at:

> - CVE-2026-24682 Heap-buffer-overflow in audio_formats_free
>   https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcw2-pqgw-mx6g

> - CVE-2026-24677 Heap-buffer-overflow in ecam_encoder_compress_h264
>   https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xw37-j744-f8v7

> - CVE-2026-24679 Heap-buffer-overflow in urb_select_interface
>   https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x

All 3 of these "Heap-buffer-overflow" issues are actually out of bounds
reads, per ASan.  It's another case of ASan mislabeling this, and people
blindly copying what it says into advisories and CVE titles.

It can't be ruled out (without code review) that if the out of bounds
reads did not terminate processing, some of them could possibly be
followed by out of bounds writes.  However, ASan is currently unable to
find this.

I wonder if besides correcting the string "Heap-buffer-overflow" ASan
could reasonably be enhanced not to terminate the task on out of bounds
reads, so that it would also have a chance to detect subsequent writes.

Alexander