GHSA-799q-hjgw-g55g: FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers
FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer() and winprconvertfromjpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.
Event History
Frequently Asked Questions
Which clients are exposed to this denial of service?
FreeRDP clients before version 3.32.2 are exposed when they process PNG or JPEG clipboard payloads from an RDP connection. The impact is client abort or exit rather than compromise of confidentiality or integrity.
What does an attacker need to exploit the issue?
An attacker must control a malicious RDP server or be positioned as a man-in-the-middle on the RDP connection, and provide a malformed PNG or truncated JPEG clipboard payload. No authentication or user interaction is required according to the supplied severity vector.
How can I tell whether a client may be affected?
Check whether the deployed FreeRDP version is earlier than 3.32.2. Affected clients may abort or exit after receiving malformed PNG clipboard data or truncated JPEG clipboard data from an RDP peer.