PT-2026-111545 · Freerdp+1 · Freerdp
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions 3.0.0 through 3.31.0
Description
A heap out-of-bounds read occurs when a malicious RD Gateway sends mismatched message lengths. An attacker controlling the gateway can set the
MsgBytes variable to be significantly larger than the NDR string ActualCount within consent or service messages. This causes the UTF-8 conversion process to read beyond the stream allocation, leading to a client crash and disruption of availability.Recommendations
Update FreeRDP to version 3.32.0.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freerdp