CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.31.0 are vulnerable to an out-of-bounds read in the URBDRC channel's func_get_ep_desc function, which improperly indexes interface arrays. This flaw allows a malicious RDP server to exploit the vulnerability by sending a specially crafted SELECT_CONFIGURATION message, potentially leading to client crashes due to unauthorized memory access. Organizations utilizing FreeRDP for remote desktop services should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.