Out-of-Bounds Read in FreeRDP RDP6 Planar RLE Decoder

Executive Summary

FreeRDP versions 3.28.0 and earlier have an out-of-bounds read flaw in the RDP6 planar RLE bitmap decoder functions. The vulnerability occurs because only the 1-byte control byte is checked for bounds, while the subsequent 0–15 raw bytes are read without verifying the source buffer contains them. A malicious RDP server can exploit this by sending a truncated bitmap, causing the client to read past the buffer's end.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the FreeRDP version in use. Run 'freerdp --version' to verify if your system is running a vulnerable version (3.28.0 or earlier). Inspect network traffic for RDP connections using tools like Wireshark with RDP protocol filters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to crash the FreeRDP client or potentially execute arbitrary code if they control the RDP server. It may lead to denial-of-service conditions or unauthorized access to sensitive data processed by the client.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later immediately. If upgrading is not possible, restrict RDP access to trusted networks or disable RDP if not required. Monitor for suspicious RDP server activity.

Useful 0 Not Useful 0