FreeRDP vulnerabilities

FreeRDP before version 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler. A malicious RDP client can send a header-only RDPEI message with a large declared body length, causing excessive memory allocation on the server.

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access paths outside the configured shared root by sending non-rooted paths that bypass boundary checks.

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. When server-purpose verification fails, the code falls back to client-purpose and any-purpose verification, allowing a certificate valid only for clientAuth to be accepted as the RDP server certificate.

FreeRDP before 3.29.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, incorrectly accepting a wildcard certificate for multi-label subdomains like a.b.example.com.

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious peer causes an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping triggers an assertion and terminates the client (denial of service).

FreeRDP before version 3.29.0 contains a heap out-of-bounds read vulnerability in glyph cache handling. A malicious RDP server can send a crafted fragment with an oversized declared size, causing a client crash.

FreeRDP before version 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can trigger a crash by sending malformed media format data.

FreeRDP before version 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders. When smartcard emulation is enabled, attackers can send crafted requests with a NULL pointer, causing strlen() on NULL and client process termination.

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

FreeRDP before version 3.28.0 treats lines beginning with a forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

Double-free vulnerability in FreeRDP before version 3.28.0 (3.x through 3.27.1) in freerdp_client_rdp_file_apply_to_settings() when parsing the selectedmonitors field of a .rdp file. An attacker can convince a victim to open a crafted .rdp file with oversized monitor tokens, causing a double-free and potentially code execution.

In FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled, a malicious RDP client can trigger a 1- to 2-byte out-of-bounds heap read. The vulnerability exists in the function processing DeviceName and VirtualChannelName fields prior to version 3.28.0.

In FreeRDP prior to version 3.27.1, when using the /cache:codec:rfx option, clients pass incorrect dimensions to RemoteFX decoding, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content.

FreeRDP before version 3.22.0 has a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

Use-after-free/double-free vulnerability in the NDR parser of RDPEAR in FreeRDP prior to version 3.26.0. A malicious server can reuse a ref-id for multiple pointer fields, causing a double free.

In FreeRDP prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle clamped to UINT16_MAX, but performs the copy using the original cacheEntry->width/height, potentially causing a large out-of-bounds heap write and leading to client crashes or code execution.

In FreeRDP prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in the server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution.

In FreeRDP before version 3.26.0, a heap-buffer-overflow vulnerability in gdi_CacheToSurface allows remote attackers to write out-of-bounds heap memory. Rectangle validation clamps coordinates to UINT16_MAX but copy operations use unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

In FreeRDP prior to version 3.24.2, in the yuv_ensure_buffer() function in h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated, leading to state inconsistency.

In FreeRDP before version 3.24.2, the resize_vbar_entry() function in libfreerdp/codec/clear.c has a heap buffer overflow vulnerability. Size update before reallocation can lead to writing attacker-controlled data beyond the allocated buffer.

In FreeRDP before version 3.24.2, a vulnerability in progressive_decompress_tile_upgrade() does not halt execution after detecting a mismatch, only logging a warning. Using a wrapped value (247) as a shift exponent causes undefined behavior and an approximately 80 billion iteration loop, resulting in CPU denial of service (DoS).

In FreeRDP before version 3.23.0, the `planar_decompress_plane_rle()` function lacks validation of destination buffer dimensions, allowing a malicious RDP server to perform a heap out-of-bounds write. An attacker can overwrite a function pointer in the `NSC_CONTEXT` structure, hijacking the client's control flow.

In FreeRDP prior to version 3.23.0, a heap buffer overflow vulnerability exists in clients using the GDI surface pipeline. A malicious RDP server can send an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle, causing a write beyond allocated memory. This allows overwriting the `codecs*` pointer in the `gdiGfxSurface` structure, leading to arbitrary code execution.

In FreeRDP prior to version 3.22.0, a use-after-free vulnerability exists in the ecam_channel_write function. A capture thread sends sample responses using a freed channel callback after a device channel close.

A flaw was found in FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability in the `RleDecompress` function due to an Out-Of-Bounds Read. This issue occurs when the `pbSrcBuffer` variable is processed without checking if it contains sufficient data.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Read in the `general_YUV444ToRGB_8u_P3AC4R_BGRX` function. This issue arises from insufficient data for the `pSrc` variable, resulting in crashes.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Write in the `writePixelBGRX` function. The issue is caused by incorrect calculations of the `nHeight` and `srcStep` variables and has been fixed in version 3.0.0-beta3.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Write in the `progressive_decompress` function. The issue is caused by incorrect calculations of the `nXSrc` and `nYSrc` variables. It has been addressed in versions 2.11.0 and 3.0.0-beta3.

FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), has a vulnerability in the `clear_decompress_bands_data` function that lacks offset validation, leading to an out-of-bounds write. Exploitation of this vulnerability may result in unauthorized writes.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability in the `general_LumaToYUV444` function due to an Out-Of-Bounds Read. This issue arises from processing the `in` variable without checking if it contains sufficient data.

FreeRDP, a free implementation of the RDP protocol, has an Integer Overflow vulnerability in the `gdi_CreateSurface` function, leading to Out-Of-Bound Write. This issue affects FreeRDP based clients only and does not affect FreeRDP proxies.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. This issue may cause application crashes.

In FreeRDP, affected versions have a missing offset validation that may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. The lack of proper boundary checks when looping through `multi_opaque_rect->numRectangles` can result in Out-of-Bounds Read errors, likely leading to a crash.

FreeRDP, a free implementation of the RDP protocol, has an issue with missing offset validation leading to out of bounds read. In the `libfreerdp/codec/rfx.c` file, the lack of validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr` can lead to application crashes.

FreeRDP, a free implementation of the RDP protocol, has an issue with offset validation leading to Out Of Bound Write. This can be triggered when `rect->left` and `rect->top` are equal to `surface->width` and `surface->height`, which should cause a crash in practice.

FreeRDP versions 3.x before beta3 are vulnerable to a Use-After-Free error when processing `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is 0, `context->planesBuffer` will be freed, leading to a potential exploit vector.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability in the `nsc_rle_decompress_data` function that allows for an Out-Of-Bounds Read. This issue arises because it does not check if `context->Planes` contains data of sufficient length.

FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to a Null Pointer Dereference leading to a crash in RemoteFX handling. The issue occurs in the `rfx_process_message_tileset` function, where improper memory allocation for tiles may result in accessing a NULL pointer.

FreeRDP has a Global-Buffer-Overflow vulnerability in the ncrush_decompress function, which can be triggered by crafted input. This issue causes application crashes and has been addressed in versions 2.11.0 and 3.0.0-beta3.