GHSA-fqw6-jf2h-6fj6: FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2
FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running a version before 3.32.2 are exposed when they connect to a malicious RDP server that can send crafted RDPGFX traffic.
What does an attacker need to exploit it?
An attacker needs to control, or cause the client to connect to, an RDP server that sends a WIRETOSURFACE_2 PDU with zero width and height. The attack requires user interaction because a user must initiate the RDP connection.
What is the impact of successful exploitation?
The crafted PDU can trigger an assertion failure or division by zero, terminating the FreeRDP client session. The provided impact information indicates an availability impact, not confidentiality or integrity impact.
What can be done if upgrading is not immediately possible?
Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers until version 3.32.2 or later can be deployed.