Out-of-bounds read in FreeRDP - #VU156174

Vulnerability details

The vulnerability allows a remote attacker to expose potentially sensitive heap memory in PNG data delivered to the local clipboard.

The vulnerability exists due to an out-of-bounds read in save_png_to_buffer() in winpr/libwinpr/utils/image.c when converting 16 bpp DIB images to PNG. A remote attacker can supply a server-controlled 16 bpp BI_BITFIELDS DIB through clipboard redirection and trigger conversion when a local application requests image/png, causing libpng to read three bytes per pixel from rows containing only two bytes per pixel and include adjacent heap bytes in the resulting image.

The vulnerable conversion requires a build with WINPR_UTILS_IMAGE_PNG enabled.

Affected software

Remediation

External References

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq

Related Security Bulletins

• Multiple vulnerabilities in FreeRDP