FreeRDP RDPGFX client heap out-of-bounds write
A remote desktop client can be hacked by a malicious server.
Summary
FreeRDP's RDPGFX client has a heap out-of-bounds write. A malicious or man-in-the-middle RDP server can crash the client and may be able to run code; versions through 3.32.1 are affected, and code execution is not proven.
Affected when
- FreeRDP client connected to a malicious or man-in-the-middle RDP server
What to do
The advisory lists 3.22.2 as the patched version, while affected versions run through 3.32.1. Update to 3.22.2 and read the advisory for details.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen