FreeRDP Client-Side Heap Out-of-Bounds Write Vulnerability

Executive Summary

This is a client-side heap out-of-bounds write vulnerability in FreeRDP versions before 3.32.0. It occurs in the functions general_LumaToYUV444 and general_ChromaV2ToYUV444 when processing RDPGFX AVC444 or AVC444v2 frames with odd-height region rectangles ending at the surface height. The flaw allows malicious RDP servers to write past allocated U/V planes, causing heap corruption and potential code execution.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP client versions and network traffic for RDPGFX AVC444/AVC444v2 frames with odd-height region rects ending at surface height. Check FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Inspect RDP server traffic for malformed AVC444 frames using Wireshark with RDP protocol filters.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable FreeRDP client, a malicious RDP server could exploit this flaw to corrupt memory on your system. This may lead to crashes, data corruption, or arbitrary code execution, potentially allowing the attacker to take control of your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized remote code execution on client systems. A successful exploit may allow attackers to access, modify, or exfiltrate sensitive data processed by the client, which is a direct violation of data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.32.0 or later. Disable AVC444/AVC444v2 decoding in client configurations if possible. Avoid connecting to untrusted RDP servers until patched. Monitor vendor advisories for additional mitigations or patches.

Useful 0 Not Useful 0