Use-after-free in FreeRDP - #VU164447

Vulnerability details

The vulnerability allows a remote attacker to expose client heap contents on screen or cause a denial of service by crashing FreeRDP.

The vulnerability exists due to use-after-free in FreeRDP brush handling for PatBlt, Mem3Blt, and PolygonCB when persistent drawing orders retain stale cache pointers and pixel depths. A remote attacker can send crafted CACHE_BRUSH and PATBLT orders from a server the victim connects to, replacing a cached brush before reusing its pointer or supplying an 8-byte inline brush with stale 24-bit depth, to trigger freed-memory or out-of-bounds reads.

Affected software

Remediation

External References

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w

Related Security Bulletins

• Multiple vulnerabilities in FreeRDP