GHSA-wffv-rjv2-h2x2: FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry
FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdpimagescale stride assertion failures that terminate the client.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious RDP server can trigger the failure against an X11 FreeRDP client. Exploitation requires a user to connect the client to that server.
What is the practical impact?
The server can cause the X11 client to terminate by sending RDPGFX MAPSURFACETOSCALEDOUTPUT data with oversized scaled-output dimensions or output-origin values. The provided impact data indicates availability impact is limited to the vulnerable client.
What versions should be remediated?
FreeRDP versions before 3.32.2 are affected. Upgrade to 3.32.2 or later.
Is exploitation automatic when a client is reachable over the network?
No. The vector is network-based, but the supplied metrics indicate high attack complexity, an additional attack requirement, and user interaction. The user must connect to the malicious RDP server.