GHSA-fw6x-h8gw-778w: FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt(), updategdipolygoncb() and updategdimem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.33.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A malicious RDP server can exploit it against a vulnerable FreeRDP client. No attacker privileges are required, but the client user must initiate or interact with an RDP connection to the malicious server.
What conditions trigger the flaw?
The server resends a CACHE_BRUSH message to a brush-cache slot and then sends a PATBLT operation. The affected update paths retain stale brush-cache pointers and may read freed heap memory.
What is the impact on an affected client?
The issue can cause the client to disclose data from freed heap memory or crash. The supplied severity vector indicates confidentiality and availability impact, with no stated integrity impact.
Which versions are affected?
FreeRDP versions before 3.33.0 are affected. Updating to 3.33.0 or later removes exposure to the stated vulnerable version range.