CVE-2025-4478
published 2025-05-16CVE-2025-4478: A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the…
PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.43%
35.1th percentile
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.15.0+dfsg-2.1 (forky) | freerdp3 3.15.0+dfsg-2.1 (forky) |
| debian | freerdp3 | < freerdp3 3.15.0+dfsg-2.1 (forky) | freerdp3 3.15.0+dfsg-2.1 (forky) |
| freerdp | freerdp | >= 3.0.0 < 3.16.0 | 3.16.0 |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FreeRDP vulnerability
vendor_ubuntu·2025-07-08
CVE-2025-4478 FreeRDP vulnerability
Title: FreeRDP vulnerability
Summary: FreeRDP could be made to crash if it received specially crafted network
traffic.
It was discovered that FreeRDP incorrectly handled certain RDP packets. A
remote attacker could possibly use this issue to cause FreeRDP to crash,
resulting in a denial of service.
Instructions: After a standard system update you need to restart your session to make all
the necessary changes.
Red Hat
gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service
vendor_redhat·2025-05-13·CVSS 6.5
CVE-2025-4478 [MEDIUM] CWE-476 gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service
gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the syst
Debian
CVE-2025-4478: freerdp2 - A flaw was found in the FreeRDP used by Anaconda's remote install feature, where...
vendor_debian·2025·CVSS 6.5
CVE-2025-4478 [MEDIUM] CVE-2025-4478: freerdp2 - A flaw was found in the FreeRDP used by Anaconda's remote install feature, where...
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
Scope: local
bookworm: resolved
bullseye: resolved
GHSA
GHSA-3p57-rq4q-233x: A flaw was found in the gnome-remote-desktop used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault
ghsa_unreviewed·2025-05-19
CVE-2025-4478 [HIGH] CWE-476 GHSA-3p57-rq4q-233x: A flaw was found in the gnome-remote-desktop used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault
A flaw was found in the gnome-remote-desktop used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
OSV
CVE-2025-4478: A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault
osv·2025-05-16·CVSS 6.5
CVE-2025-4478 [MEDIUM] CVE-2025-4478: A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-16
Published