| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | = 3.0.0> 3.0.0, < 3.32.0 | 3.32.0 |
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free