From 2beb2f81e784689dc1e7105a8930309c7e7cfac5 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Thu, 9 Apr 2026 19:09:09 +1200 Subject: [PATCH] freerdp3: fix CVE-2026-24682 Details: https://nvd.nist.gov/vuln/detail/CVE-2026-24682 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2026-24682.patch | 31 +++++++++++++++++++ .../recipes-support/freerdp/freerdp3_3.4.0.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24682.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24682.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24682.patch new file mode 100644 index 0000000000..245c3e617c --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24682.patch @@ -0,0 +1,31 @@ +From 603f5b79dc142626baed8df6b9abb23d390dfc4e Mon Sep 17 00:00:00 2001 +From: akallabeth +Date: Mon, 26 Jan 2026 10:14:08 +0100 +Subject: [PATCH] [channels,audin] fix audin_server_recv_formats cleanup + +(cherry picked from commit 1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee) + +CVE: CVE-2026-24682 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee] +Signed-off-by: Ankur Tyagi +--- + channels/audin/server/audin.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/channels/audin/server/audin.c b/channels/audin/server/audin.c +index d67937ab7..f0bf96464 100644 +--- a/channels/audin/server/audin.c ++++ b/channels/audin/server/audin.c +@@ -128,11 +128,7 @@ static UINT audin_server_recv_formats(audin_server_context* context, wStream* s, + AUDIO_FORMAT* format = &pdu.SoundFormats[i]; + + if (!audio_format_read(s, format)) +- { +- WLog_Print(audin->log, WLOG_ERROR, "Failed to read audio format"); +- audio_formats_free(pdu.SoundFormats, i + i); +- return ERROR_INVALID_DATA; +- } ++ goto fail; + + audio_format_print(audin->log, WLOG_DEBUG, format); + } diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb index 43aabf797f..8e53c47103 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb @@ -29,6 +29,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \ file://CVE-2026-24679.patch \ file://CVE-2026-24680_CVE-2026-27950.patch \ file://CVE-2026-24681.patch \ + file://CVE-2026-24682.patch \ " S = "${WORKDIR}/git"