Description (CNA)
FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| FreeRDP / FreeRDP | affected 0 before 3.26.0; unaffected 3.26.0 |
CWE
CWE-122
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff
- https://github.com/FreeRDP/FreeRDP/pull/12713
- https://github.com/FreeRDP/FreeRDP/commit/d7508ebcd82842a691ae4941e5104d14240a89ae
- https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-in-gdi-cachetosurface-via-rectangle-validation-bypass
ADP enrichment
No English description supplied.
A flaw was found in FreeRDP.If a user connects to a malicious Remote Desktop (RDP) server, a security flaw in FreeRDP could cause the application to crash or allow the server to run unauthorized code on the user's system.