Threats tagged 'ghsa-3j7f-j9fp-cvjc'

FreeRDP versions before 3.32.2 have a use-after-free vulnerability in the urbdrc USB redirection channel. This occurs because the FindChannelById function returns a channel pointer without incrementing its reference count, and the control-channel close path does not properly synchronize with the device manager's loading lock. A malicious RDP server can exploit this by sending a CLOSE_REQUEST on the control channel while the client is announcing a USB device, causing the channel to be freed prematurely and leading to a client crash.