Out-of-Bounds Read in FreeRDP Windows RAIL Client

Executive Summary

This vulnerability is an out-of-bounds read flaw in FreeRDP's Windows RAIL client. A malicious RDP server can send a non-NUL-terminated window title, causing the client to pass an improperly terminated string to SetWindowTextW. This leads to heap over-reads, potentially corrupting window titles or crashing the client.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor FreeRDP client logs for crashes or errors during RDP sessions, particularly when handling window titles. Check for non-NUL-terminated UTF-16 strings in network traffic if inspecting RDP protocol data. No specific commands are provided in the resources, but inspecting FreeRDP versions between 3.0.0 and 3.31.1 may indicate exposure.

Useful 0 Not Useful 0

Impact Analysis

The impact includes window title corruption or FreeRDP client crashes (STATUS_ACCESS_VIOLATION). It requires an active RAIL/RemoteApp session with a malicious server. No reliable code execution or full network exploit has been demonstrated, but availability issues may occur.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it primarily causes client crashes or title corruption without evidence of data exfiltration or unauthorized access. The issue is limited to availability impacts on the FreeRDP client during active RAIL/RemoteApp sessions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later to address the vulnerability. If upgrading is not possible, apply a temporary patch by modifying the client code to ensure window titles are NUL-terminated before passing them to SetWindowTextW. Avoid connecting to untrusted RDP servers until patched.

Useful 0 Not Useful 0