GHSA-m59q-wm7v-mp57: FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys
FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTableGetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP RDP clients through version 3.32.1 are exposed when they process RDPGFX data from a malicious RDP server or from an attacker able to man-in-the-middle the RDP connection. The issue is in the RDPGFX client path.
What does an attacker need to do to exploit it?
The attacker must control the RDP server or intercept and modify the RDP session. The exploit sequence involves creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, then sending ENDFRAME or RESETGRAPHICS.
What is the impact of successful exploitation?
Successful exploitation causes a heap out-of-bounds write when HashTable_GetKeys writes beyond its allocated key array. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.