GHSA-7qw2-8h66-pvpw: FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion
FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfxprocessmessage that terminates the client process.
Event History
Frequently Asked Questions
Which clients are exposed to this denial of service?
FreeRDP clients from version 3.0.0 before 3.32.2 are affected when they are built with verbose WinPR assertions. The issue is triggered by a malicious RDP server, so systems are exposed when a user connects their client to such a server.
What does an attacker need to do to trigger the issue?
The attacker needs to operate or control an RDP server that the target client connects to. They can send crafted RemoteFX region rectangles with x set to 65535 and a SurfaceBits destination left of 1, causing an assertion that terminates the client process.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates no privileges are required by the attacker, but user interaction is required. In practice, the affected FreeRDP client must connect to the malicious RDP server.