Integer Underflow in FreeRDP BMP Writer Leads to Crash

Executive Summary

FreeRDP versions 3.14.1 to 3.31.0 have an integer underflow flaw in the BMP writer when processing clipboard data. A mismatch in stride calculation for sub-byte images passes an incorrect value (SIZE_MAX - 3) to Stream_Zero, causing crashes or out-of-bounds writes. Attackers can exploit this by sending a crafted 1-bpp BMP via clipboard formats CF_DIB or CF_DIBV5.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for suspicious clipboard activity. Use 'xfreerdp --version' or 'freerdp2 --version' to verify if your FreeRDP version is between 3.14.1 and 3.31.1. Inspect clipboard-related logs for crashes or memory corruption events during BMP processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause FreeRDP clients to crash or experience memory corruption when processing malicious clipboard images. An attacker could potentially execute arbitrary code or disrupt services by exploiting this flaw through crafted BMP files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability and integrity due to potential crashes or memory corruption from crafted BMP images. While not directly targeting data confidentiality or privacy, its exploitation could lead to service disruptions or unauthorized memory access, which may indirectly affect compliance with standards like GDPR or HIPAA by compromising system reliability or exposing sensitive data during an attack.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable clipboard sharing if not required. Monitor for unusual BMP processing in clipboard logs. Apply vendor patches if using a downstream distribution of FreeRDP.

Useful 0 Not Useful 0