GHSA-cg4f-57hc-v7w7: FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder
FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
FreeRDP versions from 3.17.0 up to, but not including, 3.32.2 are affected when verbose WinPR assertions are enabled. The issue affects the client process rather than the RDP server.
What must an attacker do to trigger the crash?
An attacker needs to operate or control a malicious RDP server and have a user connect to it. The server can then send a crafted RemoteFX tile containing adjacent LL3 coefficients whose sum exceeds the signed 16-bit range.
What is the impact of successful exploitation?
The crafted tile triggers an assertion failure in the RemoteFX differential decoder, aborting the FreeRDP client process. The provided information describes a denial of service and does not indicate confidentiality or integrity impact.
What version resolves the issue?
Upgrade to FreeRDP 3.32.2 or later. The advisory identifies versions before 3.32.2 as affected.