CVE-2021-41160

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.4.1

Description The issue is related to out of bound writes in a connected client. A malicious server might trigger this by sending 0 width/height or out of bound rectangles to the client using GDI or SurfaceCommands for graphics updates. This results in missing bounds checks, allowing writes to unallocated memory regions.

Recommendations For versions prior to 2.4.1, update to FreeRDP 2.4.1 to resolve the issue. As a temporary workaround, consider restricting access to GDI or SurfaceCommands until the update is applied. Avoid using connections with 0 width/height or out of bound rectangles in the affected API endpoints until the issue is resolved.