CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.31.0 are susceptible to a heap buffer overflow due to inadequate validation of the LB_LOAD_BALANCE_INFO field length in the nego_send_negotiation_request() function. This vulnerability allows a malicious RDP server or man-in-the-middle to exploit the overflow, potentially leading to denial of service or heap corruption before user authentication. Organizations using affected FreeRDP versions should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.