GHSA-hqf8-95c7-6r92: FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response
FreeRDP 3.0.0 before 3.32.2 built with WITHAAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.
Event History
Frequently Asked Questions
Which deployments are affected?
FreeRDP versions from 3.0.0 before 3.32.2 are affected only when built with WITH_AAD=ON. The issue is in the ARM gateway response parsing path.
What does an attacker need to exploit this?
An attacker needs to operate or control a gateway selected by the user, or cause the client to use a malicious or malformed gateway. The gateway must return an ARM response with a missing or non-string redirectedServerCert field.
What is the impact of successful exploitation?
The malformed response can trigger a reachable assertion and abort the FreeRDP client process. The provided impact data indicates an availability impact limited to the vulnerable component.