Heap-based Out-of-Bounds Read in FreeRDP

Executive Summary

This is a heap-based out-of-bounds read vulnerability in FreeRDP before version 3.32.1. It occurs in WinPR's clipboard PNG-to-CF_DIB synthesis where a malicious RDP server can send a crafted low-bit-depth PNG image. When pasted by a victim, this causes the system to disclose megabytes of heap memory due to a mismatch in memory allocation and copying assumptions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system using 'xfreerdp --version' or 'apt list --installed | grep freerdp'. If the version is below 3.32.1, the system is vulnerable. Monitor network traffic for RDP connections sending PNG clipboard data, especially with low bit depth.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive data from the heap memory of applications using FreeRDP. This could include passwords, encryption keys, or other confidential information. The attack requires user interaction (pasting the image) and is triggered by a malicious RDP server sending a specially crafted PNG.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected FreeRDP versions may face compliance violations and potential legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.1 or later. Disable clipboard sharing in RDP sessions if not required. For Android/iOS clients, check for updates from official app stores. Block or monitor network traffic containing PNG clipboard payloads from untrusted RDP servers.

Useful 0 Not Useful 0