PT-2026-92075 · Freerdp+1 · Freerdp+1
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.31.0
Description
An out-of-bounds read occurs in the
func get ep desc() function within the URBDRC channel. The issue arises because interface arrays are indexed by position rather than by the protocol field InterfaceNumber. A malicious RDP server can trigger this by sending a crafted SELECT CONFIGURATION message with permuted InterfaceNumber values, allowing the server to read past allocated heap memory and cause the client to crash.Recommendations
Update FreeRDP to version 3.31.0 or later.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freerdp
Ubuntu