GHSA-x7w3-32ch-x2jq: FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()
FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in savepngtobuffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CFDIB BIBITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running a version before 3.32.2 are exposed when they connect to a malicious RDP server that provides specially crafted 16 bpp DIB clipboard content.
What must an attacker do to exploit it?
An attacker needs to operate or control an RDP server and send a CF_DIB image using BI_BITFIELDS. Exploitation occurs when that clipboard image is converted to PNG for a local application, which can embed client heap data in the resulting image.
What is the impact of successful exploitation?
A malicious RDP server can cause disclosure of client heap memory through the clipboard image. The provided impact data indicates confidentiality impact only, with no stated integrity or availability impact.
Which versions should be remediated?
Upgrade FreeRDP to version 3.32.2 or later. The vulnerability affects versions before 3.32.2.