FreeRDP Memory Safety and Certificate Vulnerabilities

Heap-based buffer overflow in FreeRDP's server-side rdpsnd audio channel before 3.32.1 lets a malicious RDP client corrupt heap memory during audio playback, potentially enabling code execution. Affected deployments are FreeRDP-based RDP servers with the rdpsnd virtual channel enabled; the CVSS 4.0 vector requires low privileges (PR:L), consistent with an established RDP client session rather than anonymous access. No public exploit code or CISA KEV confirmation was identified at time of analysis, and reliable code execution versus a crash is not confirmed.

FreeRDP proxy deployments that lack a target-certificate verification module can be tricked into accepting a self-signed or wrong-hostname certificate, letting a network-positioned attacker impersonate the RDP target and receive proxied session data. The flaw affects FreeRDP 2.0.0 before 3.32.0 and is rated 7.6 HIGH; the assessed CVSS:3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. Exploitation requires proxy mode, no configured verification module, and an on-path position on the proxy's outbound connection; no public exploit identified at time of analysis.

Heap-based out-of-bounds read in FreeRDP before 3.32.1 allows an attacker-controlled RDP server to disclose heap memory when a victim pastes a crafted low-bit-depth PNG clipboard payload. The client-side flaw occurs in WinPR's PNG-to-CF_DIB conversion, where a bit-packed buffer is allocated for sub-8-bit PNGs but rows are copied as one byte per pixel, and exploitation requires clipboard redirection plus user paste interaction. Impact is information disclosure only; no public exploit code or confirmed active exploitation was identified at time of analysis.

Client-side denial of service in FreeRDP 3.0.0 through 3.31.x occurs when the smartcard emulation backend processes a server-supplied SCardGetStatusChange reader-state entry with a null szReader name, causing a null-pointer dereference in strcmp/_wcscmp that crashes the RDP client process. Exploitation is server-to-client: an attacker-controlled or compromised RDP server can trigger the crash against a victim who connects using a FreeRDP client with the smartcard channel/emulation enabled, requiring the user to initiate or accept the session. Impact is limited to availability (client crash) with no code execution or data disclosure, and no public exploit has been identified at time of analysis.

Denial of service in FreeRDP 3.32.0: a use-after-free in the drdynvc dynamic virtual channel allows a malicious RDP server to crash the client during teardown by sending one crafted Virtual Channel PDU with a totalLength smaller than the chunk size. The victim must initiate an RDP session to the attacker-controlled or compromised server (UI:P), so passive clients are not exposed; the assessed impact is availability-only with no confidentiality or integrity loss. No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV.

Heap out-of-bounds read in the FreeRDP Android client before 3.32.1 allows a malicious or compromised RDP server to read past allocated surface buffers by supplying unvalidated mappedWidth and mappedHeight values in an RDPGFX_MAP_SURFACE_TO_WINDOW_PDU. Only Android client builds of FreeRDP that negotiate the graphics pipeline (RDPGFX) channel are affected, and because the attack direction is server-to-client, a victim must first be induced to connect to the hostile endpoint - there is no way for an attacker to reach arbitrary hosts directly. Successful exploitation yields limited heap memory disclosure and possible client crashes, with no code execution or write primitive described; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the CVSS:4.0 score of 6.9 is driven by low confidentiality impact combined with network reachability.

Heap out-of-bounds read in FreeRDP clients on Windows before 3.32.1 allows a malicious or compromised RD Gateway to leak client heap memory or crash the client through crafted pre-authentication consent or service messages. The defect is in client_cli_present_gateway_message, where a byte count is misused as a wide-character printf precision, causing roughly twice the intended buffer to be read. No public exploit code has been identified at time of analysis, and exploitation requires the client to connect through an attacker-controlled gateway, for example via lure or network redirection.