Out-of-bounds read in FreeRDP - #VU134507

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the FreeRDP client H.264 YUV-to-RGB conversion path when processing AVC420 or AVC444 GFX frames from a malicious RDP server with decoder and surface dimension mismatch. A remote attacker can send specially crafted RDP graphics data to disclose sensitive information or cause a denial of service.

Only client-side deployments using libfreerdp GFX H.264 decompression are affected, and exploitation requires RDPGFX with AVC420 or AVC444 negotiated and an H.264 decoder backend enabled.

Remediation

Sources

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6
• https://github.com/FreeRDP/FreeRDP/commit/10a002d1d6ae904a6ffd6debf1630f1278908d99