CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.31.0 are vulnerable to an out-of-bounds read due to improper buffer bounds validation in the rdpdr_dump_packet function. A malicious RDP server can exploit this vulnerability by sending a specially crafted RDPDR packet, potentially leading to client crashes or sensitive information leakage in logs. Organizations using FreeRDP should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.