Sign In
Advisories

FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding

Go back
Severity
medium
Date
Affecting

  • FreeRDP >= 2.0.0, < 3.32.0

CWE
  • CWE-122 Heap-based Buffer Overflow
CVSS
6.1
CVSS V4 Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
Kushalkhemka, mayank-jangid-moon, skigeek16, opensec-intelligence
Description
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo