| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | ≥ 3.27.1, < 3.32.0 | 3.32.0 |
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free