Skigeek16

A denial of service issue exists in the shadow server where authenticated RDP clients can cause server threads to spin by sending zero-length drdynvc DATA PDUs (Protocol Data Units). By sending empty DATA messages on opened `audin` or `rdpgfx` channels, the `FreeRDP WTSVirtualChannelRead()` function fails to consume them, leading to full CPU core consumption until the connection is terminated.

Clients built with verbose WinPR assertions contain a reachable assertion in the `rts read auth verifier()` function. An attacker controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU containing inconsistent authentication padding to trigger this assertion and abort the connecting client process.

A signature verification bypass exists in the stable self-update mechanism. The system incorrectly trusts checksums found in unsigned bytes that appear before the PGP-clearsigned SHA256SUMS block. An attacker who controls the release distribution path can prepend an unsigned checksum line that matches a malicious archive, leading the self-update process to install an attacker-controlled executable.

An integer overflow exists in the multipart reorder-memory accounting of the S3 server implementation. This issue allows the configured buffer limit to be bypassed. An attacker can trigger this by opening two concurrent current-part PUT requests with excessively large lengths, causing the signed `int64` counter to wrap. This results in out-of-order parts being retained in memory, which can lead to host resource exhaustion.

An authentication bypass exists in the Kubernetes Ingress-NGINX provider that forwards client-supplied `Ssl-Client-*` headers on the plaintext HTTP router. When `ssl-redirect` is disabled and `auth-tls-pass-certificate-to-upstream` is enabled, unauthenticated attackers can send the `Ssl-Client-Verify: SUCCESS` header with a chosen certificate subject and issuer to impersonate mTLS (mutual Transport Layer Security) identities.

A null-pointer dereference exists in the smartcard emulation backend. This occurs when the system accepts a null per-reader name during SCardGetStatusChange requests. A malicious RDP server can trigger a client process crash by sending a crafted reader-state entry containing a null `szReader` variable, which leads to a failure in the `strcmp()` or ` wcscmp()` functions.

An improper certificate validation issue exists in the proxy component. When no verification module is configured, the proxy accepts untrusted target TLS certificates. This allows network-positioned attackers to intercept outbound connections by presenting a self-signed certificate with an incorrect hostname, enabling them to impersonate the RDP target and capture proxied session data.

A heap out-of-bounds write exists in the server hash-callback NTLM path due to a failure to validate the MIC offset. An unauthenticated attacker can exploit this by sending a crafted AUTHENTICATE MESSAGE containing a backward session-key offset and MIC offset, allowing the write of 16 zero bytes beyond the allocated memory buffer.

An uncontrolled resource consumption issue exists in the `parse nla mode pdu()` function. Unauthenticated attackers can exhaust server memory by completing TLS and streaming bytes that do not begin with the DER SEQUENCE tag 0x30. This action causes the receive buffer to grow without bounds before Network Level Authentication (NLA) occurs.

The Windows RAIL client contains an out-of-bounds read issue where malicious RDP servers can trigger heap over-reads by sending window titles that are not NUL-terminated. This occurs when a full-length WINDOW ORDER FIELD TITLE update is processed by the `wf rail window common()` function and passed to `SetWindowTextW()`, which can lead to corrupted titles or client crashes.

A heap out-of-bounds read occurs in the Windows client's `CliprdrStream New()` function. This happens when a malicious RDP server sends a short clipboard response to a FILECONTENTS SIZE request by providing a `cbRequested` value of fewer than eight bytes during a remote file paste operation. This can lead to invalid memory reads, resulting in a client crash or corruption of the stream size.

An unbounded reassembly issue exists in the `WTSProcessChannelData()` function. The system fails to enforce cumulative fragment limits, allowing authenticated clients to initiate a static virtual channel message and withhold the LAST flag. This enables the transmission of endless fragments, which can lead to server memory exhaustion.

The `fetch()` implementation in this Node.js HTTP client library incorrectly verifies Subresource Integrity (SRI) metadata. The library matches the algorithm token against a lowercase-only set, causing valid uppercase or mixed-case tokens (such as SHA256) to be treated as unknown and skipped. If no recognized algorithms remain, the integrity list is treated as empty and the response is accepted regardless of whether the body matches the pinned digest. This allows an attacker who controls the response body to deliver malicious bytes to an application using non-lowercase SRI tokens without triggering an integrity error.

An issue exists in this HTTP client library for Node.js when an originless Agent composes redirect and cache interceptors in that specific order while using a shared cache store. The cache generates its key from the original request URL before the redirect handler modifies the origin, causing responses from cross-origin redirects to be stored under the original key. This can lead to persistent cache poisoning if an attacker controls the redirect target of a trusted URL. Additionally, it may result in the disclosure of private data if a private redirect response to a user-specific resource is stored under the original URL and served to unauthenticated callers. This occurs only when an originless Agent, a shared cache store, and a redirect-then-cache composition are all utilized.

The shadow server dispatches input Protocol Data Units (PDUs) during the Confirm Active state before authentication is completed. This allows unauthenticated attackers to inject synthetic keyboard input into the host user's X11 session via XTEST by negotiating TLS-only RDP and sending an input PDU without the Confirm Active state.

An HTTP header injection issue exists in the proxy component. This occurs because a lone Line Feed (LF) character within the target portion of a routing token, specifically in the `Cookie: msts=` header, is not rejected. The `http proxy connect()` function subsequently writes this character into the CONNECT request line and Host header. A remote unauthenticated RDP client can exploit this by connecting to a proxy with `FixedTarget=false` and an upstream HTTP proxy to alter the HTTP request and header framing at that upstream proxy.

A resource retention flaw exists in the `drive process irp create()` function. The issue occurs when an opened local file is registered in the drive dictionary before the allocation size is applied; if the allocation operation fails, the file is not removed. A malicious RDP server can exploit this by sending an IRP MJ CREATE request with the `AllocationSize` variable set to UINT64 MAX, causing the seek operation to fail and resulting in a leak of the file object and operating-system handle until the drive is torn down.

A heap-based buffer overflow exists in the `freerdp dsp decode mp3()` function when the software is built with `WITH LAME=ON` and `WITH DSP FFMPEG=OFF`. The issue occurs because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can exploit this by sending crafted MP3 audio over rdpsnd, causing decoded samples to exceed the heap allocation and crash the client.

A heap-based out-of-bounds write occurs in the `freerdp interruptible get line()` function. The issue arises when the buffer is reduced to 32 bytes while maintaining the length of a pre-filled suggested username as the write offset. A compromised or malicious ARM routing service can provide a long `redirectedUsername` that reaches the CLI credential prompt, leading to a client crash when the user provides input.

A NULL pointer dereference occurs in the `arm handle request ok()` function when an ARM endpoint returns an empty HTTP 200 body. An attacker controlling the configured ARM gateway can return a zero-length body, which causes a NULL value to be passed to `strnlen()`, resulting in a crash of the connecting client.