GHSA-wg7g-gx9g-r96c: FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdpdspdecodegsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients running versions from 2.0.0 up to, but not including, 3.32.2 are exposed when they connect to a malicious RDP server that can negotiate GSM610 audio through rdpsnd.
What does an attacker need to do to trigger the vulnerability?
The attacker needs to operate or control an RDP server that a user connects to. The server negotiates GSM610 audio and sends a WAVE2 message containing a truncated WAV49 frame shorter than 33 or 32 bytes.
What is the likely impact of successful exploitation?
A malicious server can cause the FreeRDP client to read beyond an audio buffer and crash. The provided data identifies availability impact only and does not indicate confidentiality or integrity impact.
How can I determine whether I am affected?
Check the FreeRDP version used by the client. Versions earlier than 3.32.2 in the affected 2.x through pre-3.32.2 range are affected; version 3.32.2 is not listed as affected.