FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is…
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft
- Product
- Remote Desktop
- CVSS
- 7.1
- EPSS
- 0.003 (p22)
- Exposure class
- Remote access
Why it ranks 28 (Notable)
- CVSS 7.1 high
- Exposed product class: remote access
- Widely deployed vendor product (Microsoft)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.