Hexer365

On Windows, a heap out-of-bounds read occurs in the `client cli present gateway message()` function when a byte count is passed as wide-character printf precision. A malicious RD Gateway can trigger this by sending pre-authentication consent or service messages, which forces the client to read twice the buffer size, potentially leading to heap memory leakage or application crashes.

A heap-based out-of-bounds read exists in the WinPR clipboard PNG-to-CF DIB synthesis. The issue occurs because the `winpr read png from buffer()` function allocates a bit-packed buffer for PNG images with a bit depth below 8, whereas the `winpr bitmap write buffer()` function copies rows under the assumption that each pixel occupies one byte. A malicious RDP server can exploit this by sending a specially crafted low-bit-depth PNG clipboard payload, which may lead to the disclosure of megabytes of heap memory when the victim pastes the content.

A heap-based buffer overflow exists in the server-side rdpsnd channel. This occurs due to an integer wraparound in the `rdpsnd server select format()` function during DVI ADPCM block-alignment arithmetic, which allows validation to be bypassed. A malicious RDP client can trigger this by sending two SNDC FORMATS PDUs with an `nBlockAlign` value that is too small for `nChannels`, leading to an unbounded heap write during server audio playback and potentially enabling remote code execution.

The `t:removeComments` transformation, implemented via the `msre fn removeComments execute()` function in `apache2/re tfns.c` and the `inplace()` function in `src/actions/transformations/remove comments.cc`, incorrectly copies the character immediately following a comment terminator without re-evaluating it. This behavior allows adjacent comments to leave a subsequent comment in the transformed value, enabling inline-comment obfuscation to bypass security rules that rely on comment stripping. Additionally, if a comment terminator is the final character of the content, the process reads one byte beyond the input buffer.

An out-of-bounds read exists in the RDP6 planar RLE bitmap decoder functions `planar decompress plane rle()` and `planar decompress plane rle only()` within libfreerdp/codec/planar.c. The system only performs a bounds check on the 1-byte control byte, failing to validate if the source buffer contains the subsequent 0–15 attacker-declared raw bytes. A compromised or malicious RDP server can trigger this by sending a truncated planar-encoded bitmap or surface update through the Bitmap Update PDU or RDPGFX Surface Command paths, forcing the client to read beyond the source buffer's end.

An open redirect issue exists in the login functionality of Blitz Panel. The issue is located in the `/login` endpoint and involves the `next url` parameter. Successful exploitation could allow an attacker to redirect a user to a malicious domain, potentially leading to phishing or token theft after authentication.