Smaeljaish771

The access-log formatter in the HTTP server can write past its log-line buffer when a custom access-log format is configured. This occurs due to allocation errors involving `%{error}x`, `%q` when the query string is empty, and numeric elements where the temporary terminating NUL reaches the end of the buffer. A specifically crafted request can cause the server to crash, although the impact of a one-byte NUL overwrite beyond a crash has not been determined.

A use-after-free issue exists where malicious RDP servers can corrupt client memory. This occurs when the RDPGFX ResetGraphics handler is raced against the planar bitmap decoder. By sending ResetGraphics concurrently with compressed bitmaps of 32 bpp (bits per pixel) or more, an attacker can trigger a heap use-after-free or out-of-bounds read/write on shared planar buffers.

The library can enter an infinite loop when opening a specially crafted incomplete PDF file. This occurs when the standard cross-reference table reaches the end of the file without a trailer, causing the trailer search to repeatedly rewind to the same stream position instead of terminating. This behavior blocks the processing thread, leading to a denial of service.

The library can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. This occurs because the clone traversal process checks generated destination references instead of the original source references, which allows certain source cycles to bypass the visited-object check.

The library can consume excessive memory when parsing a specially crafted PDF page tree that contains numerous shared resources. This occurs because page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, which allows the crafted resource structure to trigger disproportionate memory allocations.

A use-after-free issue exists in the static rdpsnd channel disconnect path. This occurs when audio formats and the device are freed without joining the `play thread` (a thread responsible for audio playback). A malicious RDP server can trigger this by disconnecting while asynchronous Wave2 playback processes queued PDUs (Protocol Data Units, which are the basic units of data transmitted over a network), leading the client to read freed heap memory and crash.

An out-of-bounds write exists in the proxy component due to improper validation of the `numCellCaches` value in the `rdp read bitmap cache v2 capability set()` function. While the function only rejects values above 5, the bitmap cache v2 cell array is subsequently accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches during the Confirm Active phase, leading to heap corruption, heap data leakage to the backend, or a system crash.

A use-after-free issue exists in the client's rdpgfx dynamic virtual channel. This occurs when a duplicate-name channel with a new `ChannelId` overwrites the listener's single callback slot, which the `rdpgfx on close()` function frees without clearing. A malicious RDP server can exploit this by opening and closing such a channel and then sending a Protocol Data Unit (PDU) on the original channel, potentially leading to a client crash or arbitrary code execution.

A heap out-of-bounds write exists in the planar codec. The issue occurs because the `freerdp bitmap planar context reset()` function commits new dimensions before buffer reallocation succeeds, while a failed ResetGraphics is only logged. A malicious RDP server can exploit this by sending an oversized ResetGraphics PDU followed by a GFX PLANAR command to corrupt client heap memory and cause the client to crash.

A double free occurs in the WinPR Kerberos SSPI `retrieveSomeTgt()` function. This happens when the krb5 default realm is installed into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can trigger this by sending a crafted NLA/CredSSP u2u TGT request where the server-name component contains the '@' character, leading to heap corruption and a crash of the server process.

A heap out-of-bounds write exists in the RDPGFX client. The issue occurs because the `delete surface()` callback truncates surface hash keys to 16 bits, causing the surface table to become inconsistent. Consequently, the `HashTable GetKeys()` function writes beyond the boundaries of its allocated key array. A malicious or man-in-the-middle RDP server can trigger this by creating a `surfaceId` of 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and subsequently sending ENDFRAME or RESETGRAPHICS.

A heap-based buffer overflow exists in the RD Gateway RPC client. The issue occurs within the `rpc client recv fragment()` function, which writes BIND ACK and ALTER CONTEXT RESP fragments into a persistent PDU (Protocol Data Unit) stream. The function incorrectly validates the buffer by checking only the total capacity instead of the remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated `alloc hint` and `frag length` values to overwrite client heap memory with attacker-controlled data, potentially leading to a crash or arbitrary code execution.

A denial-of-service issue exists in the wasi:http implementation. Guests can cause the host to panic and crash the host embedding by specifying a zero value for the `between-bytes-timeout` request option. This value is forwarded directly to a Tokio API, which triggers the panic.

A stack buffer overflow occurs when malicious guests provide mistyped component-model-async callback functions. This allows the writing of approximately 16KB to the native stack via unvalidated async callback result types, which can be used to overwrite return addresses, leading to a host crash or a sandbox escape.

A denial of service issue exists in the wasmtime-wasi WASI preview 0 `poll oneoff` adapter. The adapter performs O(n) host work per subscription without consuming or checking fuel, which is a mechanism used to limit the amount of computation a guest module can perform. Malicious guest modules can provide numerous subscriptions to trigger long-running host computations that bypass configured fuel limits.

An unbounded memory allocation exists in the `write zeroes` method of `SinkOutputStream` within `wasmtime-wasi` WASIp2, which serves as the default stream when stdout or stderr are not configured. A malicious WebAssembly guest can trigger this by requesting excessively large zero-filled writes, leading to host memory exhaustion and a resulting denial of service.

An authentication bypass exists in the sandbox noVNC helper route, which exposes interactive browser session credentials. This allows attackers to access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

A privilege escalation issue exists in the gateway plugin HTTP authentication mechanism. This flaw allows identity-bearing `operator.read` requests to be widened into runtime `operator.write` permissions. An attacker can exploit this by sending read-scoped requests through the gateway auth route to obtain unauthorized write access to runtime operations.

An issue in Playwright redirect handling allows attackers to bypass strict Server-Side Request Forgery (SSRF) checks. By exploiting request-time navigation, attackers can reach private targets that are intended to be restricted by browser SSRF protections. SSRF is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

The software fails to normalize trailing-dot localhost hosts in remote CDP (Chrome DevTools Protocol) discovery responses. This allows the bypass of loopback protections, enabling attackers to craft hostile discovery responses returning `localhost.` to retarget authenticated browser control toward localhost endpoints and expose browser state.