Executive Summary

This vulnerability exists in FreeRDP, a free implementation of the Remote Desktop Protocol, in versions prior to 3.23.0. The issue occurs because the function `rail_window_free` dereferences a pointer (`xfAppWindow`) that has already been freed during the cleanup process of a hash table (`HashTable_Free`). This happens because `xf_rail_window_common` calls `free(appWindow)` when there is a failure allocating a window title, but it does not remove the corresponding entry from the `railWindows` hash table first. As a result, a dangling pointer remains in the hash table and is freed again later upon disconnect, leading to a double-free condition.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a double-free condition, which may cause undefined behavior such as application crashes or potential exploitation by attackers. This could result in denial of service or possibly allow an attacker to execute arbitrary code or corrupt memory, depending on the environment and how the vulnerability is triggered.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FreeRDP to version 3.23.0 or later, as this version contains the fix for the issue where a freed pointer is dereferenced during cleanup.

Useful 0 Not Useful 0