CVE-2021-41159

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.4.1

Description The issue is related to a buffer overflow in the FreeRDP implementation of the Remote Desktop Protocol. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is due to the failure to validate input data in FreeRDP clients using gateway connections (/gt:rpc). A malicious gateway can write client memory out of bounds.

Recommendations For FreeRDP versions prior to 2.4.1, update to version 2.4.1 to resolve the issue. If an update is not possible, use /gt:http connections instead of /gt:rdp connections, or use a direct connection without a gateway as a temporary workaround.