Keensecuritylab

A use-after-free issue exists where malicious RDP servers can corrupt client memory. This occurs when the RDPGFX ResetGraphics handler is raced against the planar bitmap decoder. By sending ResetGraphics concurrently with compressed bitmaps of 32 bpp (bits per pixel) or more, an attacker can trigger a heap use-after-free or out-of-bounds read/write on shared planar buffers.

A use-after-free issue exists in the static rdpsnd channel disconnect path. This occurs when audio formats and the device are freed without joining the `play thread` (a thread responsible for audio playback). A malicious RDP server can trigger this by disconnecting while asynchronous Wave2 playback processes queued PDUs (Protocol Data Units, which are the basic units of data transmitted over a network), leading the client to read freed heap memory and crash.

A heap out-of-bounds write exists in the planar codec. The issue occurs because the `freerdp bitmap planar context reset()` function commits new dimensions before buffer reallocation succeeds, while a failed ResetGraphics is only logged. A malicious RDP server can exploit this by sending an oversized ResetGraphics PDU followed by a GFX PLANAR command to corrupt client heap memory and cause the client to crash.

An out-of-bounds write exists in the proxy component due to improper validation of the `numCellCaches` value in the `rdp read bitmap cache v2 capability set()` function. While the function only rejects values above 5, the bitmap cache v2 cell array is subsequently accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches during the Confirm Active phase, leading to heap corruption, heap data leakage to the backend, or a system crash.

A use-after-free issue exists in the client's rdpgfx dynamic virtual channel. This occurs when a duplicate-name channel with a new `ChannelId` overwrites the listener's single callback slot, which the `rdpgfx on close()` function frees without clearing. A malicious RDP server can exploit this by opening and closing such a channel and then sending a Protocol Data Unit (PDU) on the original channel, potentially leading to a client crash or arbitrary code execution.

A heap out-of-bounds write exists in the RDPGFX client. The issue occurs because the `delete surface()` callback truncates surface hash keys to 16 bits, causing the surface table to become inconsistent. Consequently, the `HashTable GetKeys()` function writes beyond the boundaries of its allocated key array. A malicious or man-in-the-middle RDP server can trigger this by creating a `surfaceId` of 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and subsequently sending ENDFRAME or RESETGRAPHICS.

A heap-based buffer overflow exists in the RD Gateway RPC client. The issue occurs within the `rpc client recv fragment()` function, which writes BIND ACK and ALTER CONTEXT RESP fragments into a persistent PDU (Protocol Data Unit) stream. The function incorrectly validates the buffer by checking only the total capacity instead of the remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated `alloc hint` and `frag length` values to overwrite client heap memory with attacker-controlled data, potentially leading to a crash or arbitrary code execution.

A double free occurs in the WinPR Kerberos SSPI `retrieveSomeTgt()` function. This happens when the krb5 default realm is installed into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can trigger this by sending a crafted NLA/CredSSP u2u TGT request where the server-name component contains the '@' character, leading to heap corruption and a crash of the server process.

A denial of service issue exists in the wasmtime-wasi WASI preview 0 `poll oneoff` adapter. The adapter performs O(n) host work per subscription without consuming or checking fuel, which is a mechanism used to limit the amount of computation a guest module can perform. Malicious guest modules can provide numerous subscriptions to trigger long-running host computations that bypass configured fuel limits.

An unbounded memory allocation exists in the `write zeroes` method of `SinkOutputStream` within `wasmtime-wasi` WASIp2, which serves as the default stream when stdout or stderr are not configured. A malicious WebAssembly guest can trigger this by requesting excessively large zero-filled writes, leading to host memory exhaustion and a resulting denial of service.

A stack buffer overflow occurs when malicious guests provide mistyped component-model-async callback functions. This allows the writing of approximately 16KB to the native stack via unvalidated async callback result types, which can be used to overwrite return addresses, leading to a host crash or a sandbox escape.

A denial-of-service issue exists in the wasi:http implementation. Guests can cause the host to panic and crash the host embedding by specifying a zero value for the `between-bytes-timeout` request option. This value is forwarded directly to a Tokio API, which triggers the panic.

An out-of-bounds read occurs in the `func get ep desc()` function within the URBDRC channel. The issue arises because interface arrays are indexed by position rather than by the protocol field `InterfaceNumber`. A malicious RDP server can trigger this by sending a crafted SELECT CONFIGURATION message with permuted `InterfaceNumber` values, allowing the server to read past allocated heap memory and cause the client to crash.

An out-of-bounds read occurs in the `rdpdr dump packet()` function due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with the `computerNameLen` variable set to 0xFFFFFFF0 to bypass security checks. This allows memory reads beyond the packet buffer, which can lead to client crashes or the disclosure of heap memory in logs.

An authorization bypass exists in the exec allowlist glob matching mechanism. This issue allows lower-trust callers to execute actions beyond their intended authorization by crafting input paths that traverse the allowlist glob patterns, enabling the execution or persistence of unauthorized actions when the affected feature is enabled.

An authorization bypass exists in the skill command dispatch mechanism. This issue allows lower-trust callers to execute or persist actions that exceed their intended authorization levels. When the affected feature is enabled and reachable, attackers can bypass tool policy restrictions via configured input paths to perform unauthorized actions.

An authorization bypass exists in the browser act route due to improper validation of current-tab URL checks. This allows attackers with lower-trust access or configured input paths to execute actions that require stronger authorization or policy checks.

An issue exists in the browser snapshot routes where post-navigation destinations are not properly validated. This allows attackers with lower-trust access to perform Server-Side Request Forgery (SSRF)—a technique where the server is coerced into making unauthorized requests—to bypass policy checks and access restricted network destinations.

A hook bypass issue exists where skill commands routed through a specific dispatch path skip the `runBeforeToolCallHook` coverage. This allows attackers to send skill commands through the affected path to bypass hook-based auditing and policy enforcement mechanisms. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path.

Insufficient scope validation in the Active Memory write scope allows Gateway operators with `operator.write` access to modify global configuration. This privilege escalation enables users to apply unauthorized configuration changes without requiring `operator.admin` privileges.