FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to…
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft
- Product
- Remote Desktop
- CVSS
- 7.6
- EPSS
- 0.002 (p16)
- Exposure class
- Remote access
Why it ranks 28 (Notable)
- CVSS 7.6 high
- Exposed product class: remote access
- Widely deployed vendor product (Microsoft)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.