Davidkorczynski

An issue exists where the `wasi poll oneoff()` function in `core/iwasm/libraries/libc-wasi/libc wasi wrapper.c` validates the output pointer for only one `wasi event t`, whereas the `wasmtime ssp poll oneoff()` function in `core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c` can write as many events as specified by the guest-controlled `nsubscriptions` value. A crafted guest module can provide multiple subscriptions that produce events while allocating an output region large enough for only one event. This leads to a write operation that crosses the validated Wasm linear-memory boundary into adjacent host heap memory. The resulting overwrite contains partly attacker-controlled event data, which can crash the host process or impact confidentiality and integrity depending on the heap layout.

A stack-based buffer overflow exists when handling bzip2 compressed images. An attacker can provide a specially crafted image using bzip2 compression to overwrite stack memory during the decoding process, which may lead to memory corruption or system crashes.

The tiled-TIFF decoder in the libImaging module contains a memory corruption issue. When processing tiled TIFF images, the ` decodeTile()` function allocates a buffer based on the tile size reported by libtiff. However, the subsequent stride-and-copy loop assumes the buffer is at least as large as the row stride multiplied by the tile length. If libtiff returns a tile allocation smaller than this expected size, the `copy4()` function performs a `memcpy` that reads beyond the allocated heap buffer. An attacker can exploit this by providing a specially crafted TIFF file, which may lead to a process crash (denial of service) or the exposure of adjacent heap data within the decoded pixels.

The JPEG decoder in Pillow fails to verify the actual output width and component count after a scaling request is made. When an application uses `draft()` or `thumbnail()` to request downscaling of an 8-bit lossless SOF3 JPEG, and the software is linked to libjpeg-turbo 3.x, the requested downscaling geometry may be ignored. This occurs because `ImagingJpegDecode()` does not compare the output dimensions from libjpeg against the allocated buffer size in ` setimage()`. Consequently, a full-width scanline can be written into a buffer sized for a smaller draft scale, leading to a heap memory corruption. This can result in a process crash or potentially allow arbitrary code execution. The issue is specifically triggered when the image width and height are at least 1024 pixels and a scaling factor of 2 or more is selected.

Insufficiently protected credentials occur when the `/restricted-admin` option fails to suppress CredSSP (Credential Security Support Provider) credential delegation. This results in the cleartext password being sent to the RDP server. A compromised or man-in-the-middle destination host can decode `TSPasswordCreds` and the Client Info PDU (Protocol Data Unit) to obtain reusable administrative domain, username, and password values.

The client fails to verify server-selected `PROTOCOL RDSTLS` or `PROTOCOL HYBRID EX` against the enabled protocol set within the `nego process negotiation response()` function. This flaw allows a security protocol downgrade, enabling a malicious server or man-in-the-middle attacker to select RDSTLS to override `/sec:nla` pinning. Consequently, the attacker can complete authentication using an all-zero cookie and obtain the user's cleartext password via the Client Info PDU.

An improper certificate validation issue exists in the `freerdp http request()` function within libfreerdp/utils/http.c. This flaw allows TLS handshakes to complete without verifying the server certificate chain. An on-path attacker can exploit this to impersonate login.microsoftonline.com during the Azure AD authentication flow, enabling the capture of OAuth authorization codes and the substitution of the OpenID discovery document.

The freerdp-shadow-cli shadow server fails to perform a range check on the frame id within a client's Frame Acknowledge PDU. This allows the in-flight frame count in the `shadow encoder inflight frames()` function to underflow. An authenticated client can trigger this by acknowledging a frame id that is one greater than the last frame sent, which leads to a divide-by-zero error (SIGFPE) in the `shadow encoder create frame id()` function. This results in the termination of the process and the disconnection of all viewers.

An issue exists in the `convert filedescriptors to file list()` function within `winpr/libwinpr/clipboard/synthetic file.c`. The software fails to reject `/` or `..` sequences when concatenating server-supplied `cFileName` values from `FileGroupDescriptorW` clipboard data into the local `file://` URI. This allows a malicious RDP server to use path traversal sequences to trick the client into copying an arbitrary local file readable by the user during the next clipboard paste operation.

A heap out-of-bounds read exists in the WinPR clipboard function `convert filedescriptors to file list()`. The issue occurs when the function scans a server-controlled `FILEDESCRIPTORW` `cFileName` using unbounded ` wcschr()` and `count special chars()` calls without a guarantee of NUL-termination. A malicious RDP server can trigger this by sending an odd-length `FILEDESCRIPTORW` blob in a `CB FORMAT DATA RESPONSE`, which can lead to the crashing of X11, Wayland, and SDL clients when a user attempts to paste files copied from the server.

A heap out-of-bounds read occurs in the `freerdp assistance parse all elements of()` function. This happens because the parsing cursor advances without reducing the remaining length, allowing the scan window to exceed the decrypted `ConnectionString2` buffer. An attacker can trigger a crash of xfreerdp before an RDP connection is established by providing a specially crafted .msrcIncident invitation file and password.

A heap buffer overflow occurs in the `collect keys()` function during PKCS#11 key enumeration. Local attackers can exploit this by using smartcard tokens that present more than 64 public key objects across multiple slots. This allows the attacker to write past the fixed 64-entry keys array and corrupt heap memory using custom `CKA ID` and `CKA LABEL` data during the smartcard logon process.

The software fails to check the server-supplied signed MS-RDPEGT geometry origin, storing it in an unsigned video surface coordinate. This causes the blit clamp in the `gdiVideoShowSurface()` function to wrap in 32-bit arithmetic and be skipped. A malicious RDP server can send a negative `topLevelLeft` to clients connecting via the `/video` endpoint, leading to a client abort or an out-of-bounds write of decoded H.264 picture data.

An unauthenticated remote attacker can cause a denial of service (DoS) by triggering a heap buffer overflow. This occurs when the RainerScript `replace()` function incorrectly calculates the buffer size during string replacement while processing specially crafted syslog messages, resulting in memory corruption.

The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with `mon allow r` capabilities can read the entire store by sending a crafted MMonSubscribe message. The configuration-key store contains sensitive secrets, such as OSD LUKS disk-encryption passphrases and the SSH private key used by cephadm to access hosts in the cluster. Under default cephadm configurations, this key provides root access to every node, allowing a low-privileged read-only account to achieve full cluster and host compromise.

A server-side authentication bypass exists in the RDSTLS handshake when the server is configured with `RdstlsSecurity = TRUE`. The handshake dispatches inbound PDUs based on the attacker-supplied `pduType` without verifying if the PDU is required for the current step. Since the `rdpRdstls` object is calloc-zeroed, the `resultCode` defaults to 0 (`RDSTLS RESULT SUCCESS`). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU. The function `rdstls process capabilities()` returns success without setting the `resultCode`, leading the server to respond with an `AUTHRSP` carrying a success code and treating the session as authenticated without verifying passwords, redirection GUIDs, or auto-reconnect cookies.

A heap-based buffer overflow exists in the Windows clipboard client's `CliprdrStream Read()` function. The issue occurs when an OLE paste consumer calls `IStream::Read` with a fixed-size buffer of `cb` bytes; the `CliprdrStream Read()` function then copies the response from the RDP server using the server-supplied length `req fsize` instead of the `cb` value. A compromised RDP server can send an oversized `CB FILECONTENTS RESPONSE`, leading to an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer during a clipboard paste operation.

A heap-based out-of-bounds vulnerability exists in the `kerberos DecryptMessage()` function within the `winpr/libwinpr/sspi/Kerberos/kerberos.c` file. The issue occurs because the 16-bit EC (extra count) field of a peer-supplied GSS Wrap token is used in pointer arithmetic to locate encrypted regions without proper bounds checking. A malicious peer can provide a large EC value during CredSSP/NLA authentication, causing the decryption operation's base pointers to move beyond the end of the token buffer. Since AES-CTS-HMAC enctypes perform decryption in place before the HMAC integrity check, this leads to out-of-bounds read and write operations, which may result in information disclosure, memory corruption, or denial of service.

FreeRDP treats lines starting with a forward slash in RDP files as raw command-line options, which exposes the entire CLI parser surface to untrusted files. This allows attackers to use malicious RDP files containing options such as `/rdp2tcp`, `/cert:ignore`, or `/drive` to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

A heap-based buffer overflow exists in the `crypto rsa common()` function within the `libfreerdp/crypto/crypto.c` file. The issue occurs because the function uses `BN bn2bin()` to write a modular-exponentiation result into the output buffer before validating if `output length` exceeds `out length`. When the server is configured with RDP Standard Security, an unauthenticated remote attacker can send a crafted encrypted client random. Since the server publishes its RSA public key, the attacker can forge a ciphertext that decrypts to a value up to the full modulus length (e.g., 256 bytes for RSA-2048), overflowing the fixed 32-byte heap buffer by approximately 224 bytes. This can lead to a denial of service or potentially allow the execution of arbitrary code.