Heap Out-of-Bounds Read in FreeRDP UVC H.264 Parser

Executive Summary

FreeRDP before version 3.29.0 has an out-of-bounds heap read flaw in the UVC H.264 extension-unit parser. It fails to check descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera could exploit this during camera stream setup to cause a denial of service by reading beyond allocated memory.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to local USB video camera interactions with FreeRDP. Detection requires checking FreeRDP version and monitoring for unusual USB camera behavior during stream setup. No direct network detection commands are applicable.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP with a vulnerable version and connect a malicious USB video camera, an attacker could crash your system or cause instability. This requires physical or local access to the device with the malicious camera.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later. Disable USB video camera passthrough in FreeRDP sessions if not required. Restrict physical access to systems using FreeRDP to prevent malicious USB device insertion.

Useful 0 Not Useful 0