CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.31.0 are vulnerable to an information disclosure flaw in the RDPGFX server's ResetGraphics PDU serializer, which improperly initializes padding bytes, potentially exposing uninitialized heap memory. This vulnerability allows attackers to obtain sensitive information, such as live pointers and GLib function addresses, undermining heap Address Space Layout Randomization (ASLR) and revealing the GLib module base address. Organizations using affected FreeRDP versions should prioritize patching to mitigate the risk of information leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.