Integer Overflow to Buffer Overflow in FreeRDP
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 1.3%
exploitation probability
1.3%top 30% of all CVEs
observed exploitation
nono source reports it
In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
Affected products
FreeRDP · FreeRDP