Out-of-Bounds Read in FreeRDP RDP Client

Executive Summary

FreeRDP before version 3.31.0 has an out-of-bounds read flaw in the URBDRC channel's func_get_ep_desc function. The issue occurs because the function incorrectly uses position-based indexing for interface arrays instead of using the protocol field InterfaceNumber. A malicious RDP server can exploit this by sending a specially crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values, causing the client to read beyond allocated heap memory and crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a remote attacker to crash the FreeRDP client application by sending a maliciously crafted message. If exploited, it may lead to denial-of-service conditions, disrupting legitimate remote desktop sessions. Users relying on FreeRDP for remote access could experience unexpected application failures.

Useful 0 Not Useful 0

Mitigation Strategies

Update FreeRDP to version 3.31.0 or later to address the out-of-bounds read vulnerability in the URBDRC channel.

Useful 0 Not Useful 0