CVE-2022-39319

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.9.0

Description The issue is related to missing input length validation in the urbdrc channel of the FreeRDP library. A malicious server can exploit this to trick a FreeRDP-based client into reading out-of-bound data and sending it back to the server. This could allow an attacker to gain unauthorized access to protected information or cause a denial of service.

Recommendations For versions prior to 2.9.0, upgrade to version 2.9.0 or later to address the issue. As a temporary workaround for users unable to upgrade, do not use the /usb redirection switch to minimize the risk of exploitation.