| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | ≥ 3.17.1, < 3.32.0 | 3.32.0 |
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free