FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocati…
Critical CVSS 9.8
Summary
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420Co…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c Patch
- https://github.com/FreeRDP/FreeRDP/pull/12873 Issue Tracking
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0 Release Notes
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr Exploit
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr Exploit
Timeline
- nvd_ingest NVD