Arjun Basnet

Improper neutralization of special elements in the SSH configuration manager located in `client/ssh/config/manager.go` allows a malicious or compromised peer to execute arbitrary commands on other client hosts. The client creates a system-wide OpenSSH drop-in file (such as `/etc/ssh/ssh config.d/99-netbird.conf` or `%PROGRAMDATA%sshssh config.d` on Windows) that embeds peer FQDNs or hostnames within a double-quoted Match host directive without proper escaping. A peer name containing a double quote can break the quoted context and inject arbitrary SSH configuration directives, including `exec` commands, which execute locally as any user on the host when that user runs ssh. This affects desktop clients on Linux, macOS, Windows, and FreeBSD.

A heap-based out-of-bounds write occurs in the `BoltReadHandler()` function within `src/bolt/bolt api.c`. A remote unauthenticated attacker can trigger this by sending a Bolt RESET message with a custom chunk size to the Bolt port. The issue arises because the size is validated using `ASSERT()`, which is removed during release builds. This allows the system to compute a destination pointer based on a 16-bit size provided via the wire, potentially moving buffered data up to 64 KiB before the start of the read buffer. This can lead to a denial of service or arbitrary code execution. Only deployments with the Bolt endpoint enabled via `BOLT PORT` are affected.

An improper authentication issue exists in the `is authenticated()` function (src/bolt/bolt api.c). The function determines if a password is required by sending an empty AUTH command to Redis. It incorrectly treats only a WRONGPASS error as an indication that authentication is necessary. Other errors, such as LOADING (occurring during dataset loading), MASTERDOWN (occurring during replication failover), or OOM (Out of Memory), result in the client being treated as authenticated. This allows a remote unauthenticated attacker to execute graph queries without credentials via the Bolt endpoint. This issue only affects deployments where the Bolt endpoint is enabled via `BOLT PORT`.

A type confusion issue exists in the ` read flags()` function (src/commands/cmd dispatcher.c). A remote authenticated attacker with permissions to execute `GRAPH.QUERY` can trigger this by providing a `--bolt` argument. The system casts a Redis string object to a Bolt client structure without verifying its origin, leading to the dereferencing of pointers read from that object. This can result in a denial of service, memory corruption, or memory disclosure. This issue persists even if the Bolt endpoint is disabled, affecting default configurations.

A heap-based out-of-bounds write exists in the `ws read frame()` function (src/bolt/ws.c) and the `buffer apply mask()` function (src/bolt/buffer.c). A remote unauthenticated attacker can cause a denial of service or corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. Because the payload length is not bounded and the bounds check in `buffer apply mask()` is an ASSERT() that is removed in release builds, the function XORs memory beyond the receive buffer using an attacker-supplied mask key. This issue only affects deployments where the Bolt endpoint `BOLT PORT` is enabled.

A double free and use-after-free issue exists in the `RdbLoadDeletedNodes()` function of the RDB graph decoders. A remote attacker capable of issuing Redis replication commands can trigger a denial of service or execute arbitrary code within the redis-server process. This occurs when a crafted RDB stream is provided where the deleted-nodes buffer length is not a multiple of `sizeof(NodeID)`. Because the length check utilizes `ASSERT()`, which is removed during release builds, the system proceeds to free the buffer, read it, and then free it again.

A heap-based out-of-bounds read occurs in the `BufferSerializerIOv2 ReadBuffer()` function within `src/serializers/serializer io.c`. A remote attacker capable of issuing Redis replication commands can trigger this by providing a crafted RDB stream where the sub-buffer length field is larger than the remaining buffer size. Because the bounds check relies on an `ASSERT()` that is removed during release builds, the `memcpy()` function reads beyond the allocated heap memory, potentially leading to a denial of service or the disclosure of heap memory.

A stack-based buffer overflow exists in the ` RdbLoadEntity()` function of the RDB graph decoders. A remote attacker capable of issuing Redis replication commands can trigger this issue by providing a specially crafted RDB stream containing a controlled entity property count. This count is used to size two variable-length arrays on the thread stack without an upper bound, which the decoder then populates with attacker-supplied values. This can lead to a denial of service or the execution of arbitrary code.

Uncontrolled recursion in the bundled XML parser (ofstd/libsrc/ofxml.cc) can lead to a denial of service resulting in stack exhaustion and process crash. This occurs when the parser processes a crafted XML document containing deeply nested elements. The issue is accessible via the `dcmencap` tool during CDA document encapsulation, or through any application utilizing the `parseFile()` or `parseString()` functions of `OFXMLParser` on untrusted input. The specific vulnerable functions are `ParseXMLElement()` and `emptyTheNode()` within `XMLNode`.

A global out-of-bounds read exists in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12, and libijg16). This occurs when processing a DICOM file containing a crafted JPEG stream where the Huffman table defines a difference category greater than 15. Because Huffman symbol values are not range-checked by default, an attacker can read memory beyond the `extend test[]` and `extend offset[]` tables, leading to a crash or incorrectly decoded pixel data. This affects dcmdjpeg and any application using DCMTK to decompress JPEG DICOM images.

Uncontrolled recursion in the `DcmSequenceOfItems::read()` and `DcmItem::read()` functions within the dcmdata library allows a remote, unauthenticated attacker to cause a denial of service resulting in stack exhaustion and process crash. This occurs when the software processes a DICOM dataset containing deeply nested sequences (SQ elements). The issue affects services that parse datasets before authentication, such as those using C-STORE requests in storescp, dcmrecv, and dcmqrscp, as well as local tools like dcmdump when opening a malicious file.

An out-of-bounds read issue exists in the ZRLE decoder. A malicious or compromised VNC server can trigger this by sending ZRLE-encoded tiles with palette indices that exceed the declared palette size. The functions `readPaletteRleTile()` and `readPackedPaletteTile()` use the attacker-supplied index to look up colors without validating it against the palette size. This results in out-of-bounds heap data being copied into the framebuffer, causing a garbled display, or causing a read fault that crashes the viewer.

Incorrect permission assignment allows a local authenticated user to read or overwrite the inter-process communication (IPC) handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global namespace, which carries the pipe HANDLE values, is created with a NULL DACL (Discretionary Access Control List), meaning it lacks access restrictions. Additionally, the segment name is derived from a time-seeded `srand(time(0))` value, making it predictable to one-second granularity. A low-privileged local process can open this mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to session data disclosure, privilege escalation, or denial of service.

A NULL pointer dereference in the Win8ScreenDriver component allows an attacker to crash the server, resulting in a denial of service. This occurs when the re-initialization of the DXGI Desktop Duplication driver fails within the `applyNewScreenProperties()` function, such as after a GPU reset, display hot-plug, or session change. Consequently, the `m drvImpl` variable remains NULL and is dereferenced without validation by the functions `executeDetection()`, `getScreenBuffer()`, `grabFb()`, `getScreenPropertiesChanged()`, and `getCursorPosition()`.

Uncontrolled mutual recursion occurs between the functions `parseDataSet()`, `parseElement()`, and `parseSequence()` within the `DcmJSONReader` class. An attacker can trigger a denial of service, resulting in stack exhaustion and a process crash, by providing a specially crafted DICOM JSON document containing deeply nested sequence (SQ) values. This issue affects the `json2dcm` tool and any service that utilizes this reader to convert untrusted DICOM JSON, such as DICOMweb payloads.

Uncontrolled mutual recursion between the `parseDataSet()` and `parseSequence()` functions in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) can lead to a denial of service. An attacker can trigger stack exhaustion and a process crash by providing a crafted XML file containing deeply nested sequence and item elements. This affects the `xml2dcm` tool and any service utilizing this code to convert untrusted XML to DICOM.

Uncontrolled recursion in the `moveRecordToTree()` function within dcmdata/libsrc/dcdicdir.cc can lead to a denial of service characterized by stack exhaustion and process crashes. This occurs when an attacker provides a specially crafted DICOMDIR file containing a deeply chained sequence of directory records linked via the `Offset of Referenced Lower-Level Directory Entity` attribute. Any application that opens the DICOMDIR, such as dcmgpdir or media viewers built on DCMTK, is susceptible to this issue.

A local authenticated user can execute arbitrary code with SYSTEM privileges due to an uncontrolled search path element. The `DynamicLibrary::init()` function (and ThemeLib) uses `LoadLibrary()` to load screenhooks32.dll and screenhooks64.dll using a bare file name without `LOAD LIBRARY SEARCH *` flags. This causes the service to follow the default DLL search order, allowing it to load a malicious DLL placed by an attacker in a writable directory that appears earlier in the search sequence, such as an installation directory with permissive Access Control Lists (ACLs).

An integer underflow occurs in the `trimTransparent()` function within `WinCursorShapeUtils` when a cursor shape with a width or height of zero is processed on the DXGI capture path. This allows a local authenticated user to crash the server and potentially read out-of-bounds memory. The issue arises because the loop bound `width - 1` wraps to 0xFFFFFFFF, leading to memory access approximately 4 GB beyond the 64 KB cursor buffer. Additionally, a monochrome cursor with a height of 1 is reduced to 0 because the `getCursorHeight()` function halves the height in place.

A heap-based out-of-bounds read exists in the `decodeFrame()` function within `dcmdata/libsrc/dcrleccd.cc`. This occurs when processing a crafted RLE Lossless DICOM file where the pixel data fragment is shorter than the 64-byte RLE header, allowing an attacker to read up to 63 bytes of adjacent heap memory or cause a crash. The issue stems from the function copying 64 bytes without verifying the fragment length. Applications that decode RLE images frame by frame, such as those using the `getUncompressedFrame()` function in `DcmPixelData`, are affected.