Denial of Service in FreeRDP via Malformed PNG/JPEG Clipboard Payload

Executive Summary

FreeRDP before version 3.32.2 has a denial of service vulnerability in its WinPR library functions winpr_read_png_from_buffer() and winpr_convert_from_jpeg(). These functions fail to properly handle errors from libpng and libjpeg libraries. A malicious RDP server or man-in-the-middle attacker can exploit this by sending a malformed PNG or truncated JPEG image through the clipboard, causing the FreeRDP client to crash or terminate unexpectedly.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or abnormal terminations in FreeRDP clients when handling clipboard data. Check logs for segmentation faults or application exits during PNG/JPEG clipboard operations. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to disrupt FreeRDP client sessions by sending specially crafted clipboard content. If exploited, it can cause the client application to crash, leading to denial of service for legitimate users. This could interrupt remote desktop sessions and potentially disrupt workflows that rely on RDP connections.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later to address the missing error handling in PNG/JPEG processing. Avoid using clipboard sharing with untrusted RDP servers until patched.

Useful 0 Not Useful 0