GHSA-5j39-x36c-x9pm: FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder
FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfxrlgrdecode and crashing the client.
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running versions from 3.11.0 up to, but not including, 3.32.2 are exposed when they connect to an attacker-controlled RDP server.
What must an attacker do to trigger the crash?
The attacker must control an RDP server and send the client a RemoteFX tileset containing RLGR code 32767. This triggers a signed narrowing assertion in rfx_rlgr_decode and terminates the client.
Does exploitation require authentication or user interaction?
No attacker authentication is required. A user must connect the affected FreeRDP client to the malicious RDP server.