Heap-based Out-of-Bounds Write in FreeRDP

Executive Summary

FreeRDP versions 3.18.0 through 3.31.1 have a heap-based out-of-bounds write vulnerability in the function freerdp_interruptible_get_line. A malicious or compromised ARM routing service can send a long redirectedUsername value to the FreeRDP CLI client during an ARM/RDSTLS connection without a password. The client passes this value to the credential prompt, where a helper function incorrectly handles string length and allocation. The function shrinks the buffer to 32 bytes but retains the original string length as the write offset, causing a heap overflow when user input is processed.

Useful 0 Not Useful 0

Detection Guidance

Check FreeRDP version with 'xfreerdp --version' or 'freerdp2 --version'. If using versions 3.18.0 to 3.31.1 with ARM/AAD gateway support, monitor for crashes during credential prompts. Inspect network traffic for unusually long redirectedUsername values in ARM/RDSTLS responses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the FreeRDP client to crash when a user types input at the username prompt. It requires specific conditions: FreeRDP must be built with ARM/AAD gateway support, the client must use the ARM/RDSTLS gateway flow, no password must be present during credential requests, and the ARM routing response must be malicious or compromised. The crash occurs due to a heap out-of-bounds write but does not allow unauthenticated arbitrary reachability, secret disclosure, or code execution.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later. Disable ARM/AAD gateway support if not required. Avoid using FreeRDP CLI clients with untrusted gateways. Monitor for crashes during credential prompts as potential exploitation attempts.

Useful 0 Not Useful 0