Opensec-Intelligence

A use-after-free issue exists in the asynchronous dynamic rdpsnd channel. A malicious RDP server can trigger access to a freed callback by closing the channel while audio Protocol Data Units (PDUs) are queued. By sending a training PDU and then closing the channel, the playback thread may read the freed callback within the `rdpsnd virtual channel write()` function, resulting in a client crash.

A use-after-free issue exists in the freerdp-proxy DRDYNVC tracker during the interception of the drdynvc channel. A malicious target server can trigger a proxy process crash by repeatedly sending `CREATE REQUEST PDU` for an active channel id, which creates a race condition with front DATA handling to free a borrowed context.

Server-side RDP peer input parsing fails to verify if the six-byte body of a slow-path input event with an unknown message type is within the packet's declared length. This leads to a WinPR stream assertion failure. A remote RDP client with an active session can exploit this by sending a truncated unknown input event to abort assertion-enabled server processes, resulting in a denial of service.

A denial of service issue exists in the RDPGFX ALPHA WIRETOSURFACE 2 handler. The component fails to validate zero surface dimensions, allowing a malicious RDP server to send a crafted WIRETOSURFACE 2 PDU (Protocol Data Unit) with zero width and height. This action triggers an assertion or division by zero, which terminates the client session.

A use-after-free issue exists in the urbdrc USB redirection channel. This occurs because the `FindChannelById()` function returns a channel pointer without a reference, and the control-channel close path fails to acquire the device manager's `loading lock`. A malicious RDP server can trigger this by sending a control-channel CLOSE REQUEST while the client is announcing a USB device, which frees the channel before the announcement thread reads `channel->Write`, leading to a client crash.

A denial-of-service issue exists in the `rdg process control packet()` function. A malicious RD Gateway can exhaust the client CPU by sending an incomplete keepalive control packet. After completing the RDG tunnel-open exchange, an attacker sends an eight-byte header with the `packetLength` variable set to 0xFFFF and withholds the body. This triggers an unbounded no-progress read loop, causing a single client thread to consume full CPU resources.

An issue exists where the `rdpgfx on data received` function only rejects negative `zgfx decompress` status values, leading to a null output pointer being passed to `Stream StaticConstInit`. This allows a malicious RDP server to terminate the client by sending a zero-output ZGFX payload on the RDPGFX channel after session activation, resulting in a client assertion abort.

A denial of service issue exists in the shadow server where authenticated RDP clients can cause server threads to spin by sending zero-length drdynvc DATA PDUs (Protocol Data Units). By sending empty DATA messages on opened `audin` or `rdpgfx` channels, the `FreeRDP WTSVirtualChannelRead()` function fails to consume them, leading to full CPU core consumption until the connection is terminated.

Clients built with verbose WinPR assertions contain a reachable assertion in the `rts read auth verifier()` function. An attacker controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU containing inconsistent authentication padding to trigger this assertion and abort the connecting client process.

A denial of service issue exists where a malformed drive DEVICE IOREQUEST containing a truncated IRP MJ CREATE body causes the drive worker to terminate silently. A malicious RDP server can exploit this by sending such an IRP and subsequently posting additional requests that accumulate without limit in the `IrpQueue`, leading to memory exhaustion and loss of session availability.

A denial of service issue exists where the `rdg process packet()` function dispatches a `PKT TYPE EXTENDED AUTH MSG` without verifying the negotiated mode or authentication context. A malicious or compromised RD Gateway can send an extended-auth packet before tunnel authentication, triggering a null-pointer dereference—a condition where the software attempts to read a memory location that is null—which results in a client crash.

A denial of service issue exists where malicious RDP servers can terminate clients built with verbose WinPR assertions. This occurs when the server sends crafted RemoteFX region rectangles, specifically by setting the `x` coordinate to 65535 while the SurfaceBits destination is left of 1. This sequence triggers a 16-bit coordinate assertion within the `rfx process message()` function, causing the client process to abort.

An assertion failure exists in the RemoteFX RLGR decoder. A malicious RDP server can send a RemoteFX tileset containing RLGR code 32767, which triggers a signed narrowing assertion in the `rfx rlgr decode()` function, resulting in a client crash.

[Content removed]

A file descriptor leak exists in the `parallel process irp create()` function. This occurs when the system fails to close previous descriptors during repeated IRP MJ CREATE requests. A malicious RDP server with parallel-device redirection enabled can exploit this by sending repeated CREATE requests to exhaust the client descriptor table, leading to a process crash.

A NULL pointer dereference occurs when a malicious RDP server sends a zero-width RDPGFX ResetGraphics PDU. This causes a failed resize in the `gdi resize ex()` function, which leaves the primary display null without ending the session. Consequently, a subsequent bitmap update triggers a crash in the `gdi Bitmap Paint()` function.

A memory allocation issue exists in the `rdg receive packet()` function. A malicious RD Gateway can trigger pre-authentication memory exhaustion and a denial of service by sending an eight-byte RDG header that declares a packet length of `0x7FFFFFFF`, forcing the client to allocate 2 GiB of memory before tunnel authentication occurs.

A denial of service issue exists in the `rdpdr dump packet()` function. A malicious RDP server can cause clients to abort by sending malformed RDPDR device-list announcements. This occurs when an attacker specifies a `DeviceDataLength` that exceeds the actual received packet, which triggers a fatal Stream Seek assertion. This condition is met when device redirection, TRACE logging, and WinPR assertions are enabled.

When built with `WITH AAD=ON`, the ARM gateway response parser fails to properly validate the `redirectedServerCert` field. If this field is missing or is not a string, the parser passes a null buffer to the certificate parser, triggering a reachable assertion. A malicious or malformed user-selected gateway can exploit this behavior to abort the client process.

An issue exists where the software fails to cap the `OutputBufferLength` in serial device-control IRP (I/O Request Packet) requests. A malicious server utilizing serial redirection can send an `IRP MJ DEVICE CONTROL` request with `IOCTL USBPRINT GET 1284 ID` and a near-maximum length, which triggers excessive memory allocation and can exhaust the client's memory.