GHSA-2c9x-4gr7-hrwx: FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfxondatareceived rejects only negative zgfxdecompress status and passes the resulting null output pointer to StreamStaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker controlling a malicious RDP server can exploit it against a FreeRDP client that connects to that server. The payload is sent on the RDPGFX channel after session activation.
What interaction is required for exploitation?
The user must initiate an RDP connection to the malicious server. No authentication or privileges on the client are indicated as required, but user interaction is required.
What is the impact on an affected client?
The malicious server can cause the FreeRDP client to terminate through a client assertion abort. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.
Which versions should be remediated?
FreeRDP versions before 3.32.2 are affected. Upgrade to 3.32.2 or a later version when possible.