Threats tagged 'ghsa-449c-4f3m-649w'

FreeRDP versions through 3.32.1 contain a heap out-of-bounds write vulnerability in the RDPGFX client. This occurs because the delete_surface callback truncates surface hash keys to 16 bits, causing inconsistencies in the surface table and leading to out-of-bounds writes when HashTable_GetKeys accesses the key array. An attacker controlling or intercepting the RDP server can exploit this by manipulating surface IDs and sending crafted PDUs to trigger the flaw.