CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.29.0 are vulnerable to out-of-bounds read issues in the async update message proxy, specifically affecting the PolygonSC and PolygonCB drawing orders. This vulnerability can be exploited by a malicious RDP server to cause memory disclosure or crash the client when AsyncUpdate is enabled. Organizations using FreeRDP for remote desktop connections should prioritize patching to mitigate potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points / polygonCB->points, resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash.