CVE-2025-4478

A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.

References

Affected packages

Debian:13 / freerdp3

Package

Name: freerdp3
Purl: pkg:deb/debian/freerdp3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.15.0+dfsg-2.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}